Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enable Tomcat RemoteIpValve by default

Browse Source 
Fixes gh-3782
This commit is contained in:
Dave Syer
2015-08-21 09:25:10 +01:00
parent 8543a3ca91
commit 2583f8050a
2 changed files with 32 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
View File

@@ -283,7 +283,7 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
}
if (container instanceof TomcatEmbeddedServletContainerFactory) {
getTomcat()
.customizeTomcat((TomcatEmbeddedServletContainerFactory) container);
.customizeTomcat((TomcatEmbeddedServletContainerFactory) container);
}
if (container instanceof UndertowEmbeddedServletContainerFactory) {
getUndertow().customizeUndertow(
@@ -496,13 +496,13 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
/**
* Name of the HTTP header used to override the original port value.
*/
private String portHeader;
private String portHeader = "x-forwarded-port";
/**
* Name of the http header from which the remote ip is extracted. Configured as a
* RemoteIpValve only if remoteIpHeader is also set.
*/
private String remoteIpHeader;
private String remoteIpHeader = "x-forwarded-for";
/**
* Tomcat base directory. If not specified a temporary directory will be used.
@@ -691,13 +691,16 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
String remoteIpHeader = getRemoteIpHeader();
String protocolHeader = getProtocolHeader();
if (StringUtils.hasText(remoteIpHeader)
|| StringUtils.hasText(protocolHeader)) {
&& StringUtils.hasText(protocolHeader)) {
RemoteIpValve valve = new RemoteIpValve();
valve.setRemoteIpHeader(remoteIpHeader);
valve.setProtocolHeader(protocolHeader);
// The internal proxies default to a white list of "safe" internal IP
// addresses
valve.setInternalProxies(getInternalProxies());
valve.setPortHeader(getPortHeader());
valve.setProtocolHeaderHttpsValue(getProtocolHeaderHttpsValue());
// ... so it's safe to add this valve by default.
factory.addContextValves(valve);
}
}
@@ -1012,7 +1015,7 @@ public class ServerProperties implements EmbeddedServletContainerCustomizer, Ord
* configuration.
*/
private static class SessionConfiguringInitializer implements
ServletContextInitializer {
ServletContextInitializer {
private final Session session;