public String getHostFromRequest(ServletRequest request) {
        return request.getRemoteAddr();
    }
Returns the remote host for a given HTTP request. By default uses the
remote method ServletRequest.getRemoteAddr(). May be overridden by
subclasses to obtain address information from specific headers (e.g. XFF
or Forwarded) in situations with reverse proxies.
web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java