Why is my web service forbidding my connections when using .hasIpAddress()? - spring-boot

Question

Defintieyl searched stackex for this already. Problems with hasIpAddress seem often unique.
I believe I understand the route of my reques to my server.
User -> Zuul -> My web service
http.authorizeRequests().antMatchers("/**").permitAll();
in my webservice, allows me to send requests and receive responses from localhost and my system's IP.
http.authorizeRequests().antMatchers("/**").hasIpAddress(10.10.1.24);
or
http.authorizeRequests().antMatchers("/**").hasIpAddress("127.0.0.1");
both fail.
When Zuul gives access to my web service... is it misreporting my request IP or something?
If my hasIpAddress() shouldnt be localhost, 127.0.0.1 or 10.10.1.24 then what else could it be?
I've shut down Zuul, Eureka and the ws and started them all up again.
I also did a maven clean.
2019-10-23 11:58:46.608 INFO 7468 --- [ restartedMain] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: any request, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter#27040a7b, org.springframework.security.web.context.SecurityContextPersistenceFilter#6d6a2d29, org.springframework.security.web.header.HeaderWriterFilter#3485fdae, org.springframework.security.web.authentication.logout.LogoutFilter#198a3831, org.springframework.security.web.savedrequest.RequestCacheAwareFilter#2c7fb62d, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter#20043371, org.springframework.security.web.authentication.AnonymousAuthenticationFilter#ad82f08, org.springframework.security.web.session.SessionManagementFilter#2285c828, org.springframework.security.web.access.ExceptionTranslationFilter#6511c7f9, org.springframework.security.web.access.intercept.FilterSecurityInterceptor#7e27dfef]
2019-10-23 11:58:46.618 WARN 7468 --- [ restartedMain] c.n.c.sources.URLConfigurationSource : No URLs will be polled as dynamic configuration sources.
2019-10-23 11:58:46.618 INFO 7468 --- [ restartedMain] c.n.c.sources.URLConfigurationSource : To enable URLs as dynamic configuration sources, define System property archaius.configurationSource.additionalUrls or make config.properties available on classpath.
2019-10-23 11:58:46.621 WARN 7468 --- [ restartedMain] c.n.c.sources.URLConfigurationSource : No URLs will be polled as dynamic configuration sources.
2019-10-23 11:58:46.621 INFO 7468 --- [ restartedMain] c.n.c.sources.URLConfigurationSource : To enable URLs as dynamic configuration sources, define System property archaius.configurationSource.additionalUrls or make config.properties available on classpath.
2019-10-23 11:58:46.731 INFO 7468 --- [ restartedMain] o.s.s.concurrent.ThreadPoolTaskExecutor : Initializing ExecutorService 'applicationTaskExecutor'
2019-10-23 11:58:47.264 WARN 7468 --- [ restartedMain] ockingLoadBalancerClientRibbonWarnLogger : You already have RibbonLoadBalancerClient on your classpath. It will be used by default. As Spring Cloud Ribbon is in maintenance mode. We recommend switching to BlockingLoadBalancerClient instead. In order to use it, set the value of `spring.cloud.loadbalancer.ribbon.enabled` to `false` or remove spring-cloud-starter-netflix-ribbon from your project.
2019-10-23 11:58:47.365 INFO 7468 --- [ restartedMain] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 54293 (http) with context path ''
2019-10-23 11:58:47.366 INFO 7468 --- [ restartedMain] .s.c.n.e.s.EurekaAutoServiceRegistration : Updating port to 54293
2019-10-23 11:58:47.370 INFO 7468 --- [ restartedMain] o.s.c.n.eureka.InstanceInfoFactory : Setting initial instance status as: STARTING
2019-10-23 11:58:47.392 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Initializing Eureka in region us-east-1
2019-10-23 11:58:47.491 INFO 7468 --- [ restartedMain] c.n.d.provider.DiscoveryJerseyProvider : Using JSON encoding codec LegacyJacksonJson
2019-10-23 11:58:47.492 INFO 7468 --- [ restartedMain] c.n.d.provider.DiscoveryJerseyProvider : Using JSON decoding codec LegacyJacksonJson
2019-10-23 11:58:47.570 INFO 7468 --- [ restartedMain] c.n.d.provider.DiscoveryJerseyProvider : Using XML encoding codec XStreamXml
2019-10-23 11:58:47.571 INFO 7468 --- [ restartedMain] c.n.d.provider.DiscoveryJerseyProvider : Using XML decoding codec XStreamXml
2019-10-23 11:58:47.690 INFO 7468 --- [ restartedMain] c.n.d.s.r.aws.ConfigClusterResolver : Resolving eureka endpoints via configuration
2019-10-23 11:58:47.814 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Disable delta property : false
2019-10-23 11:58:47.814 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Single vip registry refresh property : null
2019-10-23 11:58:47.814 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Force full registry fetch : false
2019-10-23 11:58:47.814 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Application is null : false
2019-10-23 11:58:47.815 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Registered Applications size is zero : true
2019-10-23 11:58:47.815 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Application version is -1: true
2019-10-23 11:58:47.815 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Getting all instance registry info from the eureka server
2019-10-23 11:58:47.890 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : The response status is 200
2019-10-23 11:58:47.892 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Starting heartbeat executor: renew interval is: 30
2019-10-23 11:58:47.894 INFO 7468 --- [ restartedMain] c.n.discovery.InstanceInfoReplicator : InstanceInfoReplicator onDemand update allowed rate per min is 4
2019-10-23 11:58:47.897 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Discovery Client initialized at timestamp 1571842727896 with initial instances count: 0
2019-10-23 11:58:47.900 INFO 7468 --- [ restartedMain] o.s.c.n.e.s.EurekaServiceRegistry : Registering application USERS-WS with eureka with status UP
2019-10-23 11:58:47.900 INFO 7468 --- [ restartedMain] com.netflix.discovery.DiscoveryClient : Saw local status change event StatusChangeEvent [timestamp=1571842727900, current=UP, previous=STARTING]
2019-10-23 11:58:47.902 INFO 7468 --- [nfoReplicator-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_USERS-WS/users-ws:90ae4ec0932916bcd2b9155854f3a269: registering service...
2019-10-23 11:58:47.945 INFO 7468 --- [nfoReplicator-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_USERS-WS/users-ws:90ae4ec0932916bcd2b9155854f3a269 - registration status: 204
2019-10-23 11:58:48.064 INFO 7468 --- [ restartedMain] c.p.p.a.u.PhotoAppApiUsersApplication : Started PhotoAppApiUsersApplication in 5.037 seconds (JVM running for 5.825)
2019-10-23 11:59:17.895 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Disable delta property : false
2019-10-23 11:59:17.895 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Single vip registry refresh property : null
2019-10-23 11:59:17.895 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Force full registry fetch : false
2019-10-23 11:59:17.896 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Application is null : false
2019-10-23 11:59:17.896 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Registered Applications size is zero : true
2019-10-23 11:59:17.896 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Application version is -1: false
2019-10-23 11:59:17.896 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : Getting all instance registry info from the eureka server
2019-10-23 11:59:17.959 INFO 7468 --- [freshExecutor-0] com.netflix.discovery.DiscoveryClient : The response status is 200

Answer 1

Here is a working basic example using spring-boot 2.2.0.RELEASE with spring-boot-starter-security and spring-boot-starter-web
Works when accessing via http://localhost:8080/ip
#SpringBootApplication
public class SpringSecurityHasIpAddressApplication {
public static void main(String[] args) {
SpringApplication.run(SpringSecurityHasIpAddressApplication.class, args);
}
}
#RestController
class HelloController {
#GetMapping("/hello")
public String hello() {
return "Hello World!";
}
#GetMapping("/ip")
public String ip(HttpServletRequest request) {
return request.getRemoteAddr();
}
#GetMapping("/secure")
public String secure(Principal principal,HttpServletRequest request) {
return principal.getName() + " with " + request.getRemoteAddr();
}
}
#Configuration
class SecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests(
authorizeRequests ->
authorizeRequests
.antMatchers("/hello").permitAll()
.antMatchers("/secure").authenticated()
.antMatchers("/ip").hasIpAddress("0:0:0:0:0:0:0:1") // localhost
.anyRequest().authenticated()
)
.formLogin();
}
}
You could access the /secure path, then you can see you're actually used IP-address.
0:0:0:0:0:0:0:1 is my localhost address so I can access /ip without authentication
By setting the log-level of org.springframework.security could also be very helpful.
application.properties
logging.level.org.springframework.security=debug
then you can see in logging something like:
2019-10-30 19:14:01.039 DEBUG 3692 --- [nio-8080-exec-6] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#536ff536: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#166c8: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 7602343558C34E2576CD0D3E20EDCBEE; Granted Authorities: ROLE_ANONYMOUS
2019-10-30 19:14:01.040 DEBUG 3692 --- [nio-8080-exec-6] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#7527e914, returned: -1
2019-10-30 19:14:01.041 DEBUG 3692 --- [nio-8080-exec-6] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
if you try via http://127.0.0.1/ip above solution will fail
then you can use
...
.antMatchers("/ip").hasIpAddress("127.0.0.1/32")
...
If you want to use a range of allowed IP-addresses then you could you use
...
.antMatchers("/access") // multiple IP matching
.access("hasIpAddress('192.168.0.1/16') or hasIpAddress('127.0.0.1/32')")
...

Answer 2

hasIpAddress(1.1.1.1) has always worked fine for me. you don't need the /32 but you can use it. it's actually the same IP with /32 on it but you really on need it if you're attempting to match a range of IPs in a subnet . My guess is you're getting the IP of Zuul and not localhost/127.0.0.1 and you're using embedded Tomcat without the <Valve className="org.apache.catalina.valves.RemoteIpValve" /> installed. Also, enable the access log for Tomcat to see what IP is hitting your service via the SPring Boot properties located at https://docs.spring.io/spring-boot/docs/current/reference/html/appendix-application-properties.html - just search for tomcat