前言

通過(guò)

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
    <version>2.3.12.RELEASE</version>
</dependency>

引入了

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-autoconfigure</artifactId>
    <version>2.3.12.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>9.0.46</version>
</dependency>

引入點(diǎn)

customizeRemoteIpValve:175, TomcatWebServerFactoryCustomizer (org.springframework.boot.autoconfigure.web.embedded)
customize:86, TomcatWebServerFactoryCustomizer (org.springframework.boot.autoconfigure.web.embedded)
customize:61, TomcatWebServerFactoryCustomizer (org.springframework.boot.autoconfigure.web.embedded)
lambda$postProcessBeforeInitialization$0:72, WebServerFactoryCustomizerBeanPostProcessor (org.springframework.boot.web.server)
accept:-1, 654232823 (org.springframework.boot.web.server.WebServerFactoryCustomizerBeanPostProcessor$$Lambda$333)
lambda$null$0:287, LambdaSafe$Callbacks (org.springframework.boot.util)
get:-1, 1039022700 (org.springframework.boot.util.LambdaSafe$Callbacks$$Lambda$330)
invoke:159, LambdaSafe$LambdaSafeCallback (org.springframework.boot.util)
lambda$invoke$1:286, LambdaSafe$Callbacks (org.springframework.boot.util)
accept:-1, 113602559 (org.springframework.boot.util.LambdaSafe$Callbacks$$Lambda$329)
forEach:1257, ArrayList (java.util)
forEach:1080, Collections$UnmodifiableCollection (java.util)
invoke:286, LambdaSafe$Callbacks (org.springframework.boot.util)
postProcessBeforeInitialization:72, WebServerFactoryCustomizerBeanPostProcessor (org.springframework.boot.web.server)
postProcessBeforeInitialization:58, WebServerFactoryCustomizerBeanPostProcessor (org.springframework.boot.web.server)
applyBeanPostProcessorsBeforeInitialization:415, AbstractAutowireCapableBeanFactory (org.springframework.beans.factory.support)
initializeBean:1791, AbstractAutowireCapableBeanFactory (org.springframework.beans.factory.support)
doCreateBean:594, AbstractAutowireCapableBeanFactory (org.springframework.beans.factory.support)
createBean:516, AbstractAutowireCapableBeanFactory (org.springframework.beans.factory.support)
lambda$doGetBean$0:324, AbstractBeanFactory (org.springframework.beans.factory.support)
getObject:-1, 1940601516 (org.springframework.beans.factory.support.AbstractBeanFactory$$Lambda$176)
getSingleton:234, DefaultSingletonBeanRegistry (org.springframework.beans.factory.support)
doGetBean:322, AbstractBeanFactory (org.springframework.beans.factory.support)
getBean:207, AbstractBeanFactory (org.springframework.beans.factory.support)
getWebServerFactory:212, ServletWebServerApplicationContext (org.springframework.boot.web.servlet.context)
createWebServer:177, ServletWebServerApplicationContext (org.springframework.boot.web.servlet.context)
onRefresh:158, ServletWebServerApplicationContext (org.springframework.boot.web.servlet.context)
refresh:545, AbstractApplicationContext (org.springframework.context.support)
refresh:143, ServletWebServerApplicationContext (org.springframework.boot.web.servlet.context)
refresh:755, SpringApplication (org.springframework.boot)
refresh:747, SpringApplication (org.springframework.boot)
refreshContext:402, SpringApplication (org.springframework.boot)
run:312, SpringApplication (org.springframework.boot)
run:1247, SpringApplication (org.springframework.boot)
run:1236, SpringApplication (org.springframework.boot)

在創(chuàng)建tomcat容器時(shí)的ServletWebServerApplicationContext#createWebServer扶踊。

ServletWebServerFactory factory = getWebServerFactory();
this.webServer = factory.getWebServer(getSelfInitializer());

getWebServerFactory()方法會(huì)從beanFactory中獲取ServletWebServerFactory對(duì)象涡驮。構(gòu)造這個(gè)bean的過(guò)程中辐棒，會(huì)執(zhí)行提前注冊(cè)好的WebServerFactoryCustomizerBeanPostProcessor誊爹。
WebServerFactoryCustomizerBeanPostProcessor.postProcessBeforeInitialization會(huì)獲取所有實(shí)現(xiàn)WebServerFactoryCustomizer的bean怠晴，并執(zhí)行他們的customize()方法熄诡。
這其中就包括TomcatWebServerFactoryCustomizer彼宠，這里增加了tomcat專用的一些features.

Customization for Tomcat-specific features common for both Servlet and Reactive servers.

其中的customizeRemoteIpValve()方法會(huì)根據(jù)條件向tomcat中加入RemoteIpValve

customizeRemoteIpValve()方法內(nèi)部會(huì)通過(guò)CloudPlatform類(lèi)判斷當(dāng)前是否是一些云或容器環(huán)境鳄虱，比如k8s等。如果是的話凭峡，就會(huì)在tomcat的engineValves中加入RemoteIpValve

RemoteIpValve

tomcat會(huì)將原始的http報(bào)文封裝成org.apache.catalina.connector.Request拙已，我們可以從中獲取到remoteAddr和http header。
RemoteIpValve中摧冀，首先判斷remoteAddr是否是內(nèi)部代理地址倍踪，內(nèi)部代理默認(rèn)是所有的內(nèi)網(wǎng)ip。
一般微服務(wù)接收到的請(qǐng)求都是經(jīng)過(guò)gateway服務(wù)調(diào)用的索昂，所以這一步判斷都是true建车。判斷為true后，RemoteIpValve會(huì)從右向左遍歷X-Forwarded-Forheader椒惨。移除遇到的內(nèi)網(wǎng)ip缤至，直到見(jiàn)到第一個(gè)公網(wǎng)ip。將這個(gè)公網(wǎng)ip從X-Forwarded-For中移除康谆，放至remoteAddr中领斥。RemoteIpValve的javadoc有更多的例子。
例如：

因?yàn)檫@塊邏輯沃暗，我們?cè)赟pring中獲取到的x-forwarded-forheader可能與原始http報(bào)文不一致月洛，user ip這是會(huì)被放到remoteAddr字段中。

題外話

如果使用x-forwarded-for的第一個(gè)ip作為用戶ip孽锥，實(shí)際是不安全的嚼黔。因?yàn)橛脩艨梢詡卧靫-forwarded-for细层。但如果使用云廠商的應(yīng)用防火墻/反向代理服務(wù)的話，云廠商一般會(huì)x-forwarded-for添加用戶真實(shí)ip唬涧。

比如
用戶發(fā)起請(qǐng)求時(shí)今艺，設(shè)置 x-forwarded-for: 111.111.111.111，111.111.111.111可以為任意偽造ip爵卒。
微服務(wù)收到的http報(bào)文為

x-forwarded-for: 111.111.111.111, 云廠商公網(wǎng)ip, 用戶真實(shí)ip, 網(wǎng)關(guān)內(nèi)網(wǎng)ip

經(jīng)過(guò)RemoteIpValve處理后虚缎，從Spring上下文中獲取的是

x-forwarded-for: 111.111.111.111, 云廠商公網(wǎng)ip

remoteAddr為用戶真實(shí)ip。

但也不能直接使用remoteAddr作為用戶真實(shí)ip钓株，因?yàn)槿绻谠茝S商服務(wù)和網(wǎng)關(guān)之間实牡，自行配置了負(fù)載均衡服務(wù)，而這個(gè)服務(wù)的配置沒(méi)有處理好的話轴合，
微服務(wù)收到的http報(bào)文會(huì)變成

x-forwarded-for: 111.111.111.111, 云廠商公網(wǎng)ip, 用戶真實(shí)ip, 負(fù)載均衡服務(wù)內(nèi)網(wǎng)ip, 111.111.111.111, 網(wǎng)關(guān)內(nèi)網(wǎng)ip

再經(jīng)過(guò)RemoteIpValve處理后创坞，從Spring上下文中獲取的是

x-forwarded-for: 111.111.111.111, 云廠商公網(wǎng)ip, 用戶真實(shí)ip, 負(fù)載均衡服務(wù)內(nèi)網(wǎng)ip,

remoteAddr為用戶偽造的111.111.111.111。

所以想在微服務(wù)中獲取用戶的真實(shí)ip受葛，需要根據(jù)實(shí)際的網(wǎng)絡(luò)鏈路配置题涨，進(jìn)行相應(yīng)的判斷，提取出云廠商服務(wù)設(shè)置的用戶真實(shí)ip总滩。