root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Doc update for ForwardedHeaderFilter 

Closes gh-23954
This commit is contained in:
Rossen Stoyanchev 2019-11-11 11:44:44 +00:00
parent 64dfa462a6
commit 1403603b05
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/docs/asciidoc/web/webmvc.adoc
View File

@ -1280,14 +1280,17 @@ that proxies can use to provide information about the original request. There ar
non-standard headers, too, including `X-Forwarded-Host`, `X-Forwarded-Port`, non-standard headers, too, including `X-Forwarded-Host`, `X-Forwarded-Port`,
`X-Forwarded-Proto`, `X-Forwarded-Ssl`, and `X-Forwarded-Prefix`. `X-Forwarded-Proto`, `X-Forwarded-Ssl`, and `X-Forwarded-Prefix`.
`ForwardedHeaderFilter` is a Servlet filter that modifies the host, port, and scheme of `ForwardedHeaderFilter` is a Servlet filter that modifies the request in order to
the request, based on `Forwarded` headers, and then removes those headers. a) change the host, port, and scheme based on `Forwarded` headers, and b) to remove those
headers to eliminate further impact. The filter relies on wrapping the request, and
therefore it must be ordered ahead of other filters, such as `RequestContextFilter`, that
should work with the modified and not the original request.
There are security considerations for forwarded headers since an application cannot know There are security considerations for forwarded headers since an application cannot know
if the headers were added by a proxy, as intended, or by a malicious client. This is why if the headers were added by a proxy, as intended, or by a malicious client. This is why
a proxy at the boundary of trust should be configured to remove untrusted `Forwarded` headers that come a proxy at the boundary of trust should be configured to remove untrusted `Forwarded`
from the outside. You can also configure the `ForwardedHeaderFilter` with headers that come from the outside. You can also configure the `ForwardedHeaderFilter`
`removeOnly=true`, in which case it removes but does not use the headers. with `removeOnly=true`, in which case it removes but does not use the headers.