Class ForwardedHeaderFilter
- java.lang.Object
- org.springframework.web.filter.GenericFilterBean
- org.springframework.web.filter.OncePerRequestFilter
- org.springframework.web.filter.ForwardedHeaderFilter
- All Implemented Interfaces:
Filter
,Aware
,BeanNameAware
,DisposableBean
,InitializingBean
,EnvironmentAware
,EnvironmentCapable
,ServletContextAware
public class ForwardedHeaderFilter extends OncePerRequestFilter
Extract values from "Forwarded" and "X-Forwarded-*" headers, wrap the request and response, and make they reflect the client-originated protocol and address in the following methods:This filter can also be used in a
removeOnly
mode where "Forwarded" and "X-Forwarded-*" headers are eliminated, and not used.- Since:
- 4.3
- Author:
- Rossen Stoyanchev, Edd煤 Mel茅ndez, Rob Winch
- See Also:
- https://tools.ietf.org/html/rfc7239
Field Summary
Fields inherited from class org.springframework.web.filter.OncePerRequestFilter
ALREADY_FILTERED_SUFFIX
Fields inherited from class org.springframework.web.filter.GenericFilterBean
logger
Constructor Summary
Constructors Constructor Description ForwardedHeaderFilter()
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected void
doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
Same contract as fordoFilter
, but guaranteed to be just invoked once per request within a single request thread.protected void
doFilterNestedErrorDispatch(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
Typically an ERROR dispatch happens after the REQUEST dispatch completes, and the filter chain starts anew.void
setRelativeRedirects(boolean relativeRedirects)
Use this property to enable relative redirects as explained inRelativeRedirectFilter
, and also using the same response wrapper as that filter does, or if both are configured, only one will wrap.void
setRemoveOnly(boolean removeOnly)
Enables mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.protected boolean
shouldNotFilter(HttpServletRequest request)
Can be overridden in subclasses for custom filtering control, returningtrue
to avoid filtering of the given request.protected boolean
shouldNotFilterAsyncDispatch()
The dispatcher typejavax.servlet.DispatcherType.ASYNC
introduced in Servlet 3.0 means a filter can be invoked in more than one thread over the course of a single request.protected boolean
shouldNotFilterErrorDispatch()
Whether to filter error dispatches such as when the servlet container processes and error mapped inweb.xml
.Methods inherited from class org.springframework.web.filter.OncePerRequestFilter
doFilter, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted
Methods inherited from class org.springframework.web.filter.GenericFilterBean
addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext
Constructor Detail
ForwardedHeaderFilter
public ForwardedHeaderFilter()
Method Detail
setRemoveOnly
public void setRemoveOnly(boolean removeOnly)
Enables mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.- Parameters:
removeOnly
- whether to discard and ignore forwarded headers- Since:
- 4.3.9
setRelativeRedirects
public void setRelativeRedirects(boolean relativeRedirects)
Use this property to enable relative redirects as explained inRelativeRedirectFilter
, and also using the same response wrapper as that filter does, or if both are configured, only one will wrap.By default, if this property is set to false, in which case calls to
HttpServletResponse.sendRedirect(String)
are overridden in order to turn relative into absolute URLs, also taking into account forwarded headers.- Parameters:
relativeRedirects
- whether to use relative redirects- Since:
- 4.3.10
shouldNotFilter
protected boolean shouldNotFilter(HttpServletRequest request)
Description copied from class:OncePerRequestFilter
Can be overridden in subclasses for custom filtering control, returningtrue
to avoid filtering of the given request.The default implementation always returns
false
.- Overrides:
shouldNotFilter
in classOncePerRequestFilter
- Parameters:
request
- current HTTP request- Returns:
- whether the given request should not be filtered
shouldNotFilterAsyncDispatch
protected boolean shouldNotFilterAsyncDispatch()
Description copied from class:OncePerRequestFilter
The dispatcher typejavax.servlet.DispatcherType.ASYNC
introduced in Servlet 3.0 means a filter can be invoked in more than one thread over the course of a single request. Some filters only need to filter the initial thread (e.g. request wrapping) while others may need to be invoked at least once in each additional thread for example for setting up thread locals or to perform final processing at the very end.Note that although a filter can be mapped to handle specific dispatcher types via
web.xml
or in Java through theServletContext
, servlet containers may enforce different defaults with regards to dispatcher types. This flag enforces the design intent of the filter.The default return value is "true", which means the filter will not be invoked during subsequent async dispatches. If "false", the filter will be invoked during async dispatches with the same guarantees of being invoked only once during a request within a single thread.
- Overrides:
shouldNotFilterAsyncDispatch
in classOncePerRequestFilter
shouldNotFilterErrorDispatch
protected boolean shouldNotFilterErrorDispatch()
Description copied from class:OncePerRequestFilter
Whether to filter error dispatches such as when the servlet container processes and error mapped inweb.xml
. The default return value is "true", which means the filter will not be invoked in case of an error dispatch.- Overrides:
shouldNotFilterErrorDispatch
in classOncePerRequestFilter
doFilterInternal
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException
Description copied from class:OncePerRequestFilter
Same contract as fordoFilter
, but guaranteed to be just invoked once per request within a single request thread. SeeOncePerRequestFilter.shouldNotFilterAsyncDispatch()
for details.Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.
- Specified by:
doFilterInternal
in classOncePerRequestFilter
- Throws:
ServletException
IOException
doFilterNestedErrorDispatch
protected void doFilterNestedErrorDispatch(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException
Description copied from class:OncePerRequestFilter
Typically an ERROR dispatch happens after the REQUEST dispatch completes, and the filter chain starts anew. On some servers however the ERROR dispatch may be nested within the REQUEST dispatch, e.g. as a result of callingsendError
on the response. In that case we are still in the filter chain, on the same thread, but the request and response have been switched to the original, unwrapped ones.Sub-classes may use this method to filter such nested ERROR dispatches and re-apply wrapping on the request or response.
ThreadLocal
context, if any, should still be active as we are still nested within the filter chain.- Overrides:
doFilterNestedErrorDispatch
in classOncePerRequestFilter
- Throws:
ServletException
IOException