From 74ef364f33e775199465592f524267ade19833b3 Mon Sep 17 00:00:00 2001 From: Dmytro Skarzhynets Date: Mon, 2 Feb 2026 14:10:39 +0200 Subject: [PATCH] fix: respect forward_headers_strategy for client IP in audit logs Remove redundant manual X-Forwarded-For header parsing in RestAuthenticationDetails. The getClientIP() method duplicated functionality already provided by Spring's ForwardedHeaderFilter when server.forward_headers_strategy is configured. Now uses request.getRemoteAddr() directly, which respects the configured forward_headers_strategy setting (default: framework). Co-Authored-By: Claude Opus 4.5 --- .../security/auth/rest/RestAuthenticationDetails.java | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAuthenticationDetails.java b/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAuthenticationDetails.java index aa084a7968..e75a49ccb2 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAuthenticationDetails.java +++ b/application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAuthenticationDetails.java @@ -29,18 +29,10 @@ public class RestAuthenticationDetails implements Serializable { private final Client userAgent; public RestAuthenticationDetails(HttpServletRequest request) { - this.clientAddress = getClientIP(request); + this.clientAddress = request.getRemoteAddr(); this.userAgent = getUserAgent(request); } - private static String getClientIP(HttpServletRequest request) { - String xfHeader = request.getHeader("X-Forwarded-For"); - if (xfHeader == null) { - return request.getRemoteAddr(); - } - return xfHeader.split(",")[0]; - } - private static Client getUserAgent(HttpServletRequest request) { Parser uaParser = new Parser(); return uaParser.parse(request.getHeader("User-Agent"));