diff --git a/src/main/java/com/alibaba/druid/support/http/stat/WebSessionStat.java b/src/main/java/com/alibaba/druid/support/http/stat/WebSessionStat.java
index 5b868db802..8e4514977d 100644
--- a/src/main/java/com/alibaba/druid/support/http/stat/WebSessionStat.java
+++ b/src/main/java/com/alibaba/druid/support/http/stat/WebSessionStat.java
@@ -262,7 +262,6 @@ public class WebSessionStat {
         }
 
         if (remoteAddresses.length() > 256) {
-            LOG.error("session ip change too many");
             return;
         }
 
diff --git a/src/main/java/com/alibaba/druid/util/DruidWebUtils.java b/src/main/java/com/alibaba/druid/util/DruidWebUtils.java
index b4d0af59b0..567a3f20fa 100644
--- a/src/main/java/com/alibaba/druid/util/DruidWebUtils.java
+++ b/src/main/java/com/alibaba/druid/util/DruidWebUtils.java
@@ -23,19 +23,54 @@ public class DruidWebUtils {
 
     public static String getRemoteAddr(HttpServletRequest request) {
         String ip = request.getHeader("x-forwarded-for");
+        if (ip != null && !isValidAddress(ip)) {
+            ip = null;
+        }
+
         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
             ip = request.getHeader("Proxy-Client-IP");
+            if (ip != null && !isValidAddress(ip)) {
+                ip = null;
+            }
         }
+
         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
             ip = request.getHeader("WL-Proxy-Client-IP");
+            if (ip != null && !isValidAddress(ip)) {
+                ip = null;
+            }
         }
+
         if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
             ip = request.getRemoteAddr();
+            if (ip != null && !isValidAddress(ip)) {
+                ip = null;
+            }
         }
 
         return ip;
     }
 
+    private static boolean isValidAddress(String ip) {
+        if (ip == null) {
+            return false;
+        }
+
+        for (int i = 0; i < ip.length(); ++i) {
+            char ch = ip.charAt(i);
+            if (ch >= '0' && ch <= '9') {
+            } else if (ch >= 'A' && ch <= 'F') {
+            } else if (ch >= 'a' && ch <= 'f') {
+            } else if (ch == '.' || ch == ':') {
+                //
+            } else {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     private static String getContextPath_2_5(ServletContext context) {
         String contextPath = context.getContextPath();