Merge pull request eugenp#305 from Doha2012/master

prevent brute force improve

Author: Eugen

spring-security-login-and-registration/src/main/java/org/baeldung/security/MyUserDetailsService.java

@@ -45,7 +45,7 @@ public MyUserDetailsService() {
 
     @Override
     public UserDetails loadUserByUsername(final String email) throws UsernameNotFoundException {
-        final String ip = request.getRemoteAddr();
+        final String ip = getClientIP();
         if (loginAttemptService.isBlocked(ip)) {
             throw new RuntimeException("blocked");
         }
@@ -88,4 +88,10 @@ private final List<GrantedAuthority> getGrantedAuthorities(final List<String> pr
         return authorities;
     }
 
+    private String getClientIP() {
+        final String xfHeader = request.getHeader("X-Forwarded-For");
+        if (xfHeader == null)
+            return request.getRemoteAddr();
+        return xfHeader.split(",")[0];
+    }
 }