Top Description Fields Constructors Methods
org.springframework.web.util

public abstract Class ForwardedHeaderUtils

extends Object
Class Inheritance
Imports
java.net.InetSocketAddress, .URI, java.util.regex.Matcher, .Pattern, org.springframework.http.HttpHeaders, org.springframework.lang.Nullable, org.springframework.util.StringUtils
Utility class to assist with processing "Forwarded" and "X-Forwarded-*" headers.

Note

There are security considerations surrounding the use of forwarded headers. Those should not be used unless the application is behind a trusted proxy that inserts them and also explicitly removes any such headers coming from an external source.

In most cases, you should not use this class directly but rather rely on org.springframework.web.filter.ForwardedHeaderFilter for Spring MVC or org.springframework.web.server.adapter.ForwardedHeaderTransformer in order to extract the information from the headers as early as possible and discard such headers. Underlying servers such as Tomcat, Jetty, and Reactor Netty also provide options to handle forwarded headers even earlier.

Author
Rossen Stoyanchev
Since
6.1

Field Summary

Modifier and TypeField and Description
private static final Pattern
FORWARDED_FOR_PATTERN

private static final Pattern
FORWARDED_HOST_PATTERN

private static final Pattern
FORWARDED_PROTO_PATTERN

private static final String
FORWARDED_VALUE

Constructor Summary

AccessConstructor and Description
public
ForwardedHeaderUtils()

Method Summary

Modifier and TypeMethod and Description
private static void
adaptForwardedHost(UriComponentsBuilder uriComponentsBuilder, String rawValue)

public static UriComponentsBuilder

Returns:

a UriComponentsBuilder that reflects the request URI and additional updates from forwarded headers
adaptFromForwardedHeaders(URI
the request URI
uri, HttpHeaders
the HTTP headers to consider
headers)

Adapt the scheme+host+port of the given URI from the "Forwarded" header (see RFC 7239) or from the "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers if "Forwarded" is not present.

private static boolean
isForwardedSslOn(HttpHeaders headers)

public static InetSocketAddress

Returns:

an InetSocketAddress with the extracted host and port, or null if the headers are not present
parseForwardedFor(URI
the request URI
uri, HttpHeaders
the request headers that may contain forwarded headers
headers, InetSocketAddress
the current remote address
remoteAddress)

Parse the first "Forwarded: for=..." or "X-Forwarded-For" header value to an InetSocketAddress representing the address of the client.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

FORWARDED_FOR_PATTERNback to summary
private static final Pattern FORWARDED_FOR_PATTERN
FORWARDED_HOST_PATTERNback to summary
private static final Pattern FORWARDED_HOST_PATTERN
FORWARDED_PROTO_PATTERNback to summary
private static final Pattern FORWARDED_PROTO_PATTERN
FORWARDED_VALUEback to summary
private static final String FORWARDED_VALUE

Constructor Detail

ForwardedHeaderUtilsback to summary
public ForwardedHeaderUtils()

Method Detail

adaptForwardedHostback to summary
private static void adaptForwardedHost(UriComponentsBuilder uriComponentsBuilder, String rawValue)
adaptFromForwardedHeadersback to summary
public static UriComponentsBuilder adaptFromForwardedHeaders(URI uri, HttpHeaders headers)

Adapt the scheme+host+port of the given URI from the "Forwarded" header (see RFC 7239) or from the "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers if "Forwarded" is not present.

Parameters
uri:URI

the request URI

headers:HttpHeaders

the HTTP headers to consider

Returns:UriComponentsBuilder

a UriComponentsBuilder that reflects the request URI and additional updates from forwarded headers

isForwardedSslOnback to summary
private static boolean isForwardedSslOn(HttpHeaders headers)
parseForwardedForback to summary
public static InetSocketAddress parseForwardedFor(URI uri, HttpHeaders headers, InetSocketAddress remoteAddress)

Parse the first "Forwarded: for=..." or "X-Forwarded-For" header value to an InetSocketAddress representing the address of the client.

Parameters
uri:URI

the request URI

headers:HttpHeaders

the request headers that may contain forwarded headers

remoteAddress:InetSocketAddress

the current remote address

Returns:InetSocketAddress

an InetSocketAddress with the extracted host and port, or null if the headers are not present

Annotations
@Nullable
See Also
RFC 7239, Section 5.2