Class ForwardedHeaderTransformer

java.lang.Object
org.springframework.web.server.adapter.ForwardedHeaderTransformer
All Implemented Interfaces:
Function<ServerHttpRequest, ServerHttpRequest>
public class ForwardedHeaderTransformer extends Object implements Function<ServerHttpRequest, ServerHttpRequest>
Extract values from the standard "Forwarded" header or the "X-Forwarded-*" alternative headers to override the request information to reflect the originating client's perspective.

An instance of this class is typically declared as a bean with the name "forwardedHeaderTransformer" and detected by WebHttpHandlerBuilder.applicationContext(ApplicationContext), or it can also be registered directly via WebHttpHandlerBuilder.forwardedHeaderTransformer(ForwardedHeaderTransformer).

An application cannot know if forwarded headers were added by a trusted proxy or by a malicious client. It is imperative that a proxy at the edge of trust is configured to drop forwarded headers from the outside, including both the standard "Forwarded" header and the "X-Forwarded-*" alternative headers.

Proxies are typically configured to support either the standard "Forwarded" header or the "X-Forwarded-*" header. Accordingly, an application must indicate which of the two alternatives it expects through a constructor argument. The "X-Forwarded-Prefix" needs to be enabled separately if needed.

Support for "X-Forwarded-Prefix" is enabled separately via setUseForwardedPrefix(boolean).

You can configure this transformer in removeOnly mode, in which case it hides the headers without using them.

Since:
5.1
Author:
Rossen Stoyanchev, Sebastien Deleuze, Mengqi Xu
See Also:

  • Constructor Details

    • ForwardedHeaderTransformer

      @Deprecated(since="7.1", forRemoval=true) public ForwardedHeaderTransformer()
      Deprecated, for removal: This API element is subject to removal in a future version.
      as of 7.1, in favor of ForwardedHeaderTransformer(boolean)
      A default constructor with the historic behavior so far, which is to check both the standard "Forwarded" header and the "X-Forwarded-*" alternative headers in that order, also with "X-Forwarded-Prefix" enabled by default.

      This behavior depends on proxies being configured correctly to clear both standard "Forwarded" and "X-Forwarded-*" header values coming from the outside. Going forward, applications must explicitly declare which forwarded headers are expected.

    • ForwardedHeaderTransformer

      public ForwardedHeaderTransformer(boolean useStandardHeader)
      Create an instance of the transformer and specify whether it should use the standard "Forwarded" header or the "X-Forwarded-*" alternative headers.

      "X-Forwarded-Prefix" is enabled separately via setUseForwardedPrefix(boolean).

      Parameters:
      useStandardHeader - whether to use the standard "Forwarded" header (true), or the "X-Forwarded-*" alternative headers (false).
      Since:
      6.1.29

  • Method Details

    • setUseForwardedPrefix

      public void setUseForwardedPrefix(boolean useForwardedPrefix)
      Enable use of "X-Forwarded-Prefix" to determine the context path.

      By default, this is set to "false" in which case the header is ignored.

      Since:
      6.1.29

    • setRemoveOnly

      public void setRemoveOnly(boolean removeOnly)
      Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.
      Parameters:
      removeOnly - whether to discard and ignore forwarded headers

    • isRemoveOnly

      public boolean isRemoveOnly()
      Whether the "remove only" mode is on.
      See Also:

    • apply

      public ServerHttpRequest apply(ServerHttpRequest request)
      Apply and remove, or remove Forwarded type headers.
      Specified by:
      apply in interface Function<ServerHttpRequest, ServerHttpRequest>
      Parameters:
      request - the request

    • hasForwardedHeaders

      protected boolean hasForwardedHeaders(ServerHttpRequest request)
      Whether the request has any Forwarded headers.
      Parameters:
      request - the request