ServerHttpRequest#getURI()) so it reflects
the client-originated protocol and address.
An instance of this class is typically declared as a bean with the name
"forwardedHeaderTransformer" and detected by
WebHttpHandlerBuilder#applicationContext(ApplicationContext), or it
can also be registered directly via
WebHttpHandlerBuilder#forwardedHeaderTransformer(ForwardedHeaderTransformer).
There are security considerations for forwarded headers since an application cannot know if the headers were added by a proxy, as intended, or by a malicious client. This is why a proxy at the boundary of trust should be configured to remove untrusted Forwarded headers that come from the outside.
You can also configure the ForwardedHeaderFilter with removeOnly,
in which case it removes but does not use the headers.
| Modifier and Type | Field and Description |
|---|---|
| pack-priv static final Set | |
| private boolean |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| private static URI | |
| public ServerHttpRequest | apply(ServerHttpRequest
the request request)Implements java. |
| private static String | |
| protected boolean | hasForwardedHeaders(ServerHttpRequest
the request request)Whether the request has any Forwarded headers. |
| public boolean | |
| private void | |
| public void | setRemoveOnly(boolean
whether to discard and ignore forwarded headers removeOnly)Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored. |
| FORWARDED_HEADER_NAMES | back to summary |
|---|---|
| pack-priv static final Set<String> FORWARDED_HEADER_NAMES | |
| removeOnly | back to summary |
|---|---|
| private boolean removeOnly | |
| ForwardedHeaderTransformer | back to summary |
|---|---|
| public ForwardedHeaderTransformer() | |
| adaptFromForwardedHeaders | back to summary |
|---|---|
| private static URI adaptFromForwardedHeaders(URI uri, HttpHeaders headers) | |
| apply | back to summary |
|---|---|
| public ServerHttpRequest apply(ServerHttpRequest request) Implements java. Apply and remove, or remove Forwarded type headers.
| |
| getForwardedPrefix | back to summary |
|---|---|
private static String getForwardedPrefix(ServerHttpRequest request)
| |
| hasForwardedHeaders | back to summary |
|---|---|
| protected boolean hasForwardedHeaders(ServerHttpRequest request) Whether the request has any Forwarded headers.
| |
| isRemoveOnly | back to summary |
|---|---|
| public boolean isRemoveOnly() Whether the "remove only" mode is on.
| |
| removeForwardedHeaders | back to summary |
|---|---|
| private void removeForwardedHeaders(ServerHttpRequest. | |
| setRemoveOnly | back to summary |
|---|---|
| public void setRemoveOnly(boolean removeOnly) Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.
| |