ServletServerHttpRequest.getRemoteAddress() may perform DNS lookup

The ServletServerHttpRequest#getRemoteAddress method may perform a DNS lookup in certain scenarios (and same goes for its reactive counterpart).

If the underlying jakarta.servlet.ServletRequest#getRemoteHost implementation does a DNS lookup (as it is allowed, but not required to do), then calling ServletServerHttpRequest#getRemoteAddress will also do a DNS lookup. ServletServerHttpRequest#getRemoteAddress is for example called by Spring's ForwardedHeaderFilter.

As the ServletServerHttpRequest#getRemoteAddress return type is InetSocketAddress it feels like doing DNS resolution is quite pointless in general.

I have been trying to extract a minimal reproducer but I'm having some trouble getting it reproduced in a minimal setting. It might involve WebSocket via JSR 356 using Atmosphere and Jetty as the servlet container.

Similar to #28280.

Quoting #28280 (comment)

The AbstractStandardUpgradeStrategy still tries to get InetSocketAddresses during upgrade:

	@Override
  public void upgrade(ServerHttpRequest request, ServerHttpResponse response,
  		@Nullable String selectedProtocol, List<WebSocketExtension> selectedExtensions,
  		@Nullable Principal user, WebSocketHandler wsHandler, Map<String, Object> attrs)
  		throws HandshakeFailureException {

  	HttpHeaders headers = request.getHeaders();
  	InetSocketAddress localAddr = null;
  	try {
  		localAddr = request.getLocalAddress();
  	}
  	catch (Exception ex) {
  		// Ignore
  	}
  	InetSocketAddress remoteAddr = null;
  	try {
  		remoteAddr = request.getRemoteAddress();
  	}
  	catch (Exception ex) {
  		// Ignore
  	}

and ServerHttpRequest uses constructor of InetSocketAddress, which performs DNS lookup:

	@Override
  public InetSocketAddress getLocalAddress() {
  	return new InetSocketAddress(this.servletRequest.getLocalAddr(), this.servletRequest.getLocalPort());
  }

  @Override
  public InetSocketAddress getRemoteAddress() {
  	return new InetSocketAddress(this.servletRequest.getRemoteHost(), this.servletRequest.getRemotePort());
  }

(checked on spring 5.3.20 and java 17)

Use getRemoteAddr in ServletServerHttpRequest

Fixed via 2c83144

@rstoyanchev

Thanks a lot @rstoyanchev for fixing this so quickly, much appreciated!

Fall back on remoteHost if remoteAddress is null

I've made an an adjustment to fall back remoteHost if the remoteAddress is null for any reason. We've run into internal test failures, and although I'm not sure if that can happen at runtime, it doesn't hurt to have a fallback since otherwise the null address results an IllegalArgumentException.

Navigation Menu

Repository navigation

ServletServerHttpRequest.getRemoteAddress() may perform DNS lookup #35589

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ServletServerHttpRequest.getRemoteAddress() may perform DNS lookup #35589

Description

Activity

slovdahl commented on Oct 9, 2025

github-actions commented on Oct 10, 2025

slovdahl commented on Oct 10, 2025

rstoyanchev commented on Oct 15, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions