Class ForwardedHeaderUtils

java.lang.Object

org.springframework.web.util.ForwardedHeaderUtils

public abstract class ForwardedHeaderUtils
extends Object

Utility class to assist with processing "Forwarded" and "X-Forwarded-*" headers.

Note: There are security considerations surrounding the use of forwarded headers. Those should not be used unless the application is behind a trusted proxy that inserts them and also explicitly removes any such headers coming from an external source.

In most cases, you should not use this class directly but rather rely on ForwardedHeaderFilter for Spring MVC or ForwardedHeaderTransformer in order to extract the information from the headers as early as possible and discard such headers. Underlying servers such as Tomcat, Jetty, and Reactor Netty also provide options to handle forwarded headers even earlier.

Since:

6.1

Author:

Rossen Stoyanchev

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	ForwardedHeaderUtils.ForwardedInfo	Container for the combined results of parsing either the "Forwarded" header or the "X-Forwarded-*" alternative headers.

Constructor Summary

Constructors

Constructor	Description
ForwardedHeaderUtils()

Method Summary

Modifier and Type	Method	Description
static UriComponentsBuilder	adaptFromForwardedHeaders(URI uri, HttpHeaders headers)	Deprecated, for removal: This API element is subject to removal in a future version. as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)
static @Nullable InetSocketAddress	parseForwardedBy(URI uri, HttpHeaders headers, @Nullable InetSocketAddress localAddress)	Deprecated, for removal: This API element is subject to removal in a future version. as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)
static @Nullable InetSocketAddress	parseForwardedFor(URI uri, HttpHeaders headers, @Nullable InetSocketAddress remoteAddress)	Deprecated, for removal: This API element is subject to removal in a future version. as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)
static ForwardedHeaderUtils.ForwardedInfo	parseStandardHeader(URI uri, HttpHeaders headers)	Parse the "Forwarded" header.
static ForwardedHeaderUtils.ForwardedInfo	parseStandardHeader(URI uri, HttpHeaders headers, @Nullable InetSocketAddress remoteAddress, @Nullable InetSocketAddress localAddress)	Deprecated, for removal: This API element is subject to removal in a future version. as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) which does not use a fallback port from the remote or local address
static ForwardedHeaderUtils.ForwardedInfo	parseXForwardedHeaders(URI uri, HttpHeaders headers)	Parse the "X-Forwarded-Proto", "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-For" headers, the alternative to the "Forwarded" header.
static ForwardedHeaderUtils.ForwardedInfo	parseXForwardedHeaders(URI uri, HttpHeaders headers, @Nullable InetSocketAddress remoteAddress, @Nullable InetSocketAddress localAddress)	Deprecated, for removal: This API element is subject to removal in a future version. as of 7.1 in favor of parseXForwardedHeaders(URI, HttpHeaders) which does not use a fallback port from the remote address

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ForwardedHeaderUtils

public ForwardedHeaderUtils()

Method Details

parseStandardHeader

public static ForwardedHeaderUtils.ForwardedInfo parseStandardHeader(URI uri,
 HttpHeaders headers)

Parse the "Forwarded" header.

If the parsed "for" or "by" value does not include a port, the resulting InetSocketAddress has port 0 to indicate it is unknown.

Parameters:

uri - the request URI

headers - the HTTP headers to get the "Forwarded" header from

Returns:

a ForwardedHeaderUtils.ForwardedInfo with the parse results

Since:

7.1

See Also:

• RFC 7239

parseStandardHeader

@Deprecated(since="7.1",
            forRemoval=true)
public static ForwardedHeaderUtils.ForwardedInfo parseStandardHeader(URI uri,
 HttpHeaders headers,
 @Nullable InetSocketAddress remoteAddress,
 @Nullable InetSocketAddress localAddress)

Deprecated, for removal: This API element is subject to removal in a future version.

as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) which does not use a fallback port from the remote or local address

Parse the "Forwarded" header.

Parameters:

uri - the request URI

headers - the HTTP headers to get the "Forwarded" header from

remoteAddress - for a default port for the parsed "for" value

localAddress - for a default port for the parsed "by" value

Returns:

a ForwardedHeaderUtils.ForwardedInfo with the parse results

Since:

6.1.29

See Also:

• RFC 7239

parseXForwardedHeaders

public static ForwardedHeaderUtils.ForwardedInfo parseXForwardedHeaders(URI uri,
 HttpHeaders headers)

Parse the "X-Forwarded-Proto", "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-For" headers, the alternative to the "Forwarded" header.

The "X-Forwarded-For" value does not include a port, and therefore the resulting InetSocketAddress has port 0 to indicate that the port is not known.

There is no parsing of "X-Forwarded-By" currently, so the byAddress in ForwardedHeaderUtils.ForwardedInfo is always null.

Parameters:

uri - the request URI

headers - the HTTP headers to get the "X-Forwarded-*" headers from

Returns:

a ForwardedHeaderUtils.ForwardedInfo with the scheme, host, and port adapted from the "X-Forwarded-*" headers, and the parsed "for" address

Since:

7.1

parseXForwardedHeaders

@Deprecated(since="7.1",
            forRemoval=true)
public static ForwardedHeaderUtils.ForwardedInfo parseXForwardedHeaders(URI uri,
 HttpHeaders headers,
 @Nullable InetSocketAddress remoteAddress,
 @Nullable InetSocketAddress localAddress)

Deprecated, for removal: This API element is subject to removal in a future version.

as of 7.1 in favor of parseXForwardedHeaders(URI, HttpHeaders) which does not use a fallback port from the remote address

Parse the "X-Forwarded-Proto", "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-For" headers, the alternative to the "Forwarded" header.

There is no parsing of "X-Forwarded-By" currently, so the byAddress in ForwardedHeaderUtils.ForwardedInfo is always null.

Parameters:

uri - the request URI

headers - the HTTP headers to get the "Forwarded" header from

remoteAddress - for a default port for the parsed "for" value

localAddress - for a default port for the parsed "by" value; this argument is ignored currently and the byAddress is always null

Returns:

a ForwardedHeaderUtils.ForwardedInfo with the scheme, host, and port adapted from the "X-Forwarded-*" headers, and the parsed "for" address

Since:

6.1.29

adaptFromForwardedHeaders

@Deprecated(since="7.1",
            forRemoval=true)
public static UriComponentsBuilder adaptFromForwardedHeaders(URI uri,
 HttpHeaders headers)

Deprecated, for removal: This API element is subject to removal in a future version.

as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)

Adapt the scheme+host+port of the given URI from the "Forwarded" header (see RFC 7239) or from the "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers if "Forwarded" is not present.

Parameters:

uri - the request URI

headers - the HTTP headers to consider

Returns:

a UriComponentsBuilder that reflects the request URI and additional updates from forwarded headers

parseForwardedFor

@Deprecated(since="7.1",
            forRemoval=true)
public static @Nullable InetSocketAddress parseForwardedFor(URI uri,
 HttpHeaders headers,
 @Nullable InetSocketAddress remoteAddress)

Deprecated, for removal: This API element is subject to removal in a future version.

as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)

Parse the first "Forwarded: for=..." or "X-Forwarded-For" header value to an InetSocketAddress representing the address of the client.

Parameters:

uri - the request URI

headers - the request headers that may contain forwarded headers

remoteAddress - the current remote address

Returns:

an InetSocketAddress with the extracted host and port, or null if the headers are not present

parseForwardedBy

@Deprecated(since="7.1",
            forRemoval=true)
public static @Nullable InetSocketAddress parseForwardedBy(URI uri,
 HttpHeaders headers,
 @Nullable InetSocketAddress localAddress)

Deprecated, for removal: This API element is subject to removal in a future version.

as of 7.1 in favor of parseStandardHeader(URI, HttpHeaders) and parseXForwardedHeaders(URI, HttpHeaders)

Parse the first "Forwarded: by=..." header value to an InetSocketAddress representing the address of the server.

Parameters:

uri - the request URI

headers - the request headers that may contain forwarded headers

localAddress - the current local address

Returns:

an InetSocketAddress with the extracted host and port, or null if the headers are not present

Since:

7.0