defect
(User-visible)
If the application is behind a facade (which is usually the case), then the session service does not return the client's address; instead, it logically returns the facade's address for all clients.
Test
- In a deployed application running behind an Apache web server, check whether the IP address of the requesting computer is actually logged (for both successful and failed logins).