org.springframework.web.server.adapter

Class ForwardedHeaderTransformer

java.lang.Object

org.springframework.web.server.adapter.ForwardedHeaderTransformer

All Implemented Interfaces:

Function<ServerHttpRequest,ServerHttpRequest>

Direct Known Subclasses:

ForwardedHeaderFilter

public class ForwardedHeaderTransformer
extends Object
implements Function<ServerHttpRequest,ServerHttpRequest>

Extract values from "Forwarded" and "X-Forwarded-*" headers to override the request URI (i.e. HttpRequest.getURI()) so it reflects the client-originated protocol and address.

An instance of this class is typically declared as a bean with the name "forwardedHeaderTransformer" and detected by WebHttpHandlerBuilder.applicationContext(ApplicationContext), or it can also be registered directly via WebHttpHandlerBuilder.forwardedHeaderTransformer(ForwardedHeaderTransformer).

There are security considerations for forwarded headers since an application cannot know if the headers were added by a proxy, as intended, or by a malicious client. This is why a proxy at the boundary of trust should be configured to remove untrusted Forwarded headers that come from the outside.

You can also configure the ForwardedHeaderFilter with removeOnly, in which case it removes but does not use the headers.

Since:

5.1

Author:

Rossen Stoyanchev

See Also:

https://tools.ietf.org/html/rfc7239

Constructor Summary

Constructors

Constructor and Description
ForwardedHeaderTransformer()

Method Summary

Modifier and Type	Method and Description
ServerHttpRequest	apply(ServerHttpRequest request) Apply and remove, or remove Forwarded type headers.
protected boolean	hasForwardedHeaders(ServerHttpRequest request) Whether the request has any Forwarded headers.
boolean	isRemoveOnly() Whether the "remove only" mode is on.
void	setRemoveOnly(boolean removeOnly) Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.function.Function

andThen, compose, identity

Constructor Detail

ForwardedHeaderTransformer

public ForwardedHeaderTransformer()

Method Detail

setRemoveOnly

public void setRemoveOnly(boolean removeOnly)

Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.

Parameters:

removeOnly - whether to discard and ignore forwarded headers

isRemoveOnly

public boolean isRemoveOnly()

Whether the "remove only" mode is on.

See Also:

setRemoveOnly(boolean)

apply

public ServerHttpRequest apply(ServerHttpRequest request)

Apply and remove, or remove Forwarded type headers.

Specified by:

apply in interface Function<ServerHttpRequest,ServerHttpRequest>

Parameters:

request - the request

hasForwardedHeaders

protected boolean hasForwardedHeaders(ServerHttpRequest request)

Whether the request has any Forwarded headers.

Parameters:

request - the request