{"record":{"id":"080a9b2a4789fd92","repo":"apereo/cas","slug":"no-value-could-be-retrieved-from-the-header","errorCode":null,"errorMessage":"No value could be retrieved from the header [{}]. Falling back to [{}].","messagePattern":"No value could be retrieved from the header \\[(.+?)\\]\\. Falling back to \\[(.+?)\\]\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"support/cas-server-support-spnego-webflow/src/main/java/org/apereo/cas/web/flow/client/BaseSpnegoKnownClientSystemsFilterAction.java","lineNumber":151,"sourceCode":"    /**\n     * Pulls the remote IP from the current HttpServletRequest, or grabs the value\n     * for the specified alternative attribute (say, for proxied requests).  Falls\n     * back to providing the \"normal\" remote address if no value can be retrieved\n     * from the specified alternative header value.\n     *\n     * @param context the context\n     * @return the remote ip\n     */\n    private String getRemoteIp(final RequestContext context) {\n        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);\n        var userAddress = request.getRemoteAddr();\n        LOGGER.debug(\"Remote Address = [{}]\", userAddress);\n        if (StringUtils.isNotBlank(this.alternativeRemoteHostAttribute)) {\n            userAddress = request.getHeader(this.alternativeRemoteHostAttribute);\n            LOGGER.debug(\"Header Attribute [{}] = [{}]\", this.alternativeRemoteHostAttribute, userAddress);\n            if (StringUtils.isBlank(userAddress)) {\n                userAddress = request.getRemoteAddr();\n                LOGGER.warn(\"No value could be retrieved from the header [{}]. Falling back to [{}].\", this.alternativeRemoteHostAttribute, userAddress);\n            }\n        }\n        return userAddress;\n    }\n}\n","sourceCodeStart":133,"sourceCodeEnd":157,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-spnego-webflow/src/main/java/org/apereo/cas/web/flow/client/BaseSpnegoKnownClientSystemsFilterAction.java#L133-L157","documentation":"BaseSpnegoKnownClientSystemsFilterAction determines the client's remote IP for SPNEGO decisions (e.g. checking whether the host is a known client system). When the configured alternativeRemoteHostAttribute header (e.g. X-Forwarded-For style custom header) yields nothing, it logs this warning and falls back to servlet request.getRemoteAddr(). It is informational: a fallback occurs, not a failure.","triggerScenarios":"getRemoteIp is called with alternativeRemoteHostAttribute set (e.g. 'X-FORWARDED-FOR' or a custom header), but the incoming request lacks that header (blank value), so request.getRemoteAddr() is used instead.","commonSituations":"Requests bypassing the proxy that was supposed to set the alternative header (direct access, health checks); header name mismatch (wrong case/spacing) between config and what the proxy sends; load balancer not configured to forward client IP.","solutions":["Verify the proxy/load balancer actually sends the configured header on every request path.","Fix the header name in cas.authn.spnego.alternative-remote-host-attribute to match exactly what the proxy emits.","If CAS is reachable directly, accept the getRemoteAddr() fallback or restrict direct access.","Log/inspect incoming headers to confirm the expected header is present."],"exampleFix":"// before\ncas.authn.spnego.alternative-remote-host-attribute=X-CLIENT-IP\n// after\ncas.authn.spnego.alternative-remote-host-attribute=X-Forwarded-For","handlingStrategy":"fallback","validationCode":"String ip = request.getHeader(altHeader);\nif (ip == null || ip.isBlank()) ip = request.getRemoteAddr(); // same fallback CAS applies","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure LB/proxy to always set the forwarded-IP header","Match header name exactly (case/spacing)","Block direct-to-CAS traffic that bypasses the proxy"],"tags":["spnego","remote-ip","proxy","http-header"],"backgroundTag":"fallback-applied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}