Certainly! Implementing IP whitelisting in a Spring Boot application can help enhance security. Here's an example of how you can achieve this using Spring Security:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${whitelist.ips}") // Assuming you have a property in your application.properties file for whitelisted IPs
    private List<String> whitelistIps;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                // Add other URL patterns to be secured
                .antMatchers("/api/**").hasIpAddress(whitelistIps.toArray(new String[0]))
                .anyRequest().authenticated()
                .and()
                .csrf().disable()
                .httpBasic();
    }

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/public/**"); // Add any public URLs that should not be protected IP whitelisting
    }
}

In this example, the configuration uses the hasIpAddress method to allow access only from the whitelisted IPs defined in the whitelist.ips property. Be sure to define the list of whitelisted IPs in your application.properties file like this:

whitelist.ips=192.168.1.100, 192.168.1.101

Remember to adjust the configuration according to your specific requirements and use case.

HTTP headers X-Forwarded-For or X-Real-IP are often used to identify the originating IP address of a client connecting to a web server through a proxy or load balancer.

To handle this in a Spring Boot application, you might want to create a method for extracting the correct IP value from these headers. Here is a simple example:

import javax.servlet.http.HttpServletRequest;

public static String getClientIp(HttpServletRequest request) {
    String remoteAddr = "";

    if (request != null) {
        remoteAddr = request.getHeader("X-FORWARDED-FOR");
        if (remoteAddr == null || "".equals(remoteAddr)) {
            remoteAddr = request.getRemoteAddr();
        }
    }

    return remoteAddr;
}

In this code, request.getHeader("X-FORWARDED-FOR") will return the originating IP (as set the proxy server), if the setup is behind a proxy. If not, then request.getRemoteAddr() will give you the IP address.

Remember to validate this method for your setup, as handling proxies might vary based on your network configuration. Especially in case you are behind multiple proxy servers, the X-Forwarded-For may contain multiple IPs. In that case, the first IP in the list will be the client's real IP.

Sure, here's the complete code which includes IP Whitelisting using Spring Boot and handling proxy IP addresses:

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.util.matcher.IpAddressMatcher;

import javax.servlet.http.HttpServletRequest;
import java.util.List;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${wh.ips}")
    private List<String> whitelistIps;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/api/**").access(this::checkIpAddress)
                .anyRequest().authenticated()
                .and()
                .csrf().disable()
                .httpBasic();
    }

    private boolean checkIpAddress(HttpServletRequest request) {
        String ipAddress = getClientIpAddress(request);
        return whitelistIps.stream()
                .anyMatch(ip -> new IpAddressMatcher(ip).matches(ipAddress));
    }

    private String getClientIpAddress(HttpServletRequest request) {
        String xForwardedForHeader = request.getHeader("X-FORWARDED-FOR");
        if (xForwardedForHeader == null) {
            return requestRemoteAddr();
        } else {
            return new StringTokenizer(xForwardedForHeader, ",").nextToken().trim();
        }
    }
}

In the application.properties file:

whitelist.ips=192.168.1.100, 192.168.1.101

This code includes method getClientIpAddress() to extract the correct IP address considering the X-Forwarded-For header. If the application is not behind a proxy, it will give the remote address using request.getRemoteAddr(). If the application is behind a proxy, it takes the first IP address from X-Forwarded-For header. The IP address is then checked against the whitelist using the checkIpAddress() method. If the IP address is in the whitelist, access is granted.

Please adapt the source code according to your security needs and verify all the security configurations or rules. Always ensure the security strategy aligns with your organization's policies and guides.

Ah, I see! In that case, you can use the X-Relayed-From header instead of X-Forwarded-For to identify the originating IP address of the client.

Here's an updated version of the getClientIpAddress() method that takes into account the X-Relayed-From header:

private String getClientIpAddress(HttpServletRequest request) {
    String xRelayedFromHeader = request.getHeader("X-Relayed-From");
    if (xRelayedFromHeader != null) {
        return xRelayedFromHeader.trim();
    } else {
        return requestRemoteAddr();
    }
}

By the X-Relayed-From header, you can get the originating IP address of the client, even if it's behind a proxy server.

Keep in mind that Cloudflare may log or analyze the traffic entering their network, so you may want to consider using a different proxy solution if you want to keep your IP address private.