Backport of relative redirect filter support

Issue: SPR-15717

spring-web/src/main/java/org/springframework/web/filter/ForwardedHeaderFilter.java

@@ -31,6 +31,7 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpServletResponseWrapper;
 
 import org.springframework.http.HttpRequest;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.server.ServletServerHttpRequest;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.LinkedCaseInsensitiveMap;
@@ -78,6 +79,8 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 
 	private boolean removeOnly;
 
+	private boolean relativeRedirects;
+
 
 	public ForwardedHeaderFilter() {
 		this.pathHelper = new UrlPathHelper();
@@ -89,13 +92,28 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 	/**
 	 * Enables mode in which any "Forwarded" or "X-Forwarded-*" headers are
 	 * removed only and the information in them ignored.
-	 * @param removeOnly whether to discard and ingore forwarded headers
+	 * @param removeOnly whether to discard and ignore forwarded headers
 	 * @since 4.3.9
 	 */
 	public void setRemoveOnly(boolean removeOnly) {
 		this.removeOnly = removeOnly;
 	}
 
+	/**
+	 * Use this property to enable relative redirects as explained in and also
+	 * using the same response wrapper as {@link RelativeRedirectFilter} does.
+	 * Or if both filters are used, only one will wrap the response.
+	 * <p>By default, if this property is set to false, in which case calls to
+	 * {@link HttpServletResponse#sendRedirect(String)} are overridden in order
+	 * to turn relative into absolute URLs since (which Servlet containers are
+	 * also required to do) also taking forwarded headers into consideration.
+	 * @param relativeRedirects whether to use relative redirects
+	 * @since 4.3.10
+	 */
+	public void setRelativeRedirects(boolean relativeRedirects) {
+		this.relativeRedirects = relativeRedirects;
+	}
+
 
 	@Override
 	protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
@@ -129,7 +147,9 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 		}
 		else {
 			HttpServletRequest theRequest = new ForwardedHeaderExtractingRequest(request, this.pathHelper);
-			HttpServletResponse theResponse = new ForwardedHeaderExtractingResponse(response, theRequest);
+			HttpServletResponse theResponse = (this.relativeRedirects ?
+					RelativeRedirectResponseWrapper.wrapIfNecessary(response, HttpStatus.SEE_OTHER) :
+					new ForwardedHeaderExtractingResponse(response, theRequest));
 			filterChain.doFilter(theRequest, theResponse);
 		}
 	}
@@ -142,7 +162,6 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 
 		private final Map<String, List<String>> headers;
 
-
 		public ForwardedHeaderRemovingRequest(HttpServletRequest request) {
 			super(request);
 			this.headers = initHeaders(request);
@@ -180,6 +199,7 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 		}
 	}
 
+
 	/**
 	 * Extract and use "Forwarded" or "X-Forwarded-*" headers.
 	 */
@@ -199,7 +219,6 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 
 		private final String requestUrl;
 
-
 		public ForwardedHeaderExtractingRequest(HttpServletRequest request, UrlPathHelper pathHelper) {
 			super(request);
 
@@ -276,10 +295,8 @@ public class ForwardedHeaderFilter extends OncePerRequestFilter {
 
 		private static final String FOLDER_SEPARATOR = "/";
 
-
 		private final HttpServletRequest request;
 
-
 		public ForwardedHeaderExtractingResponse(HttpServletResponse response, HttpServletRequest request) {
 			super(response);
 			this.request = request;

spring-web/src/main/java/org/springframework/web/filter/RelativeRedirectFilter.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2002-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.web.filter;
+
+import java.io.IOException;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.util.Assert;
+
+/**
+ * Overrides {@link HttpServletResponse#sendRedirect(String)} and handles it by
+ * setting the HTTP status and "Location" headers. This keeps the Servlet
+ * container from re-writing relative redirect URLs and instead follows the
+ * recommendation in <a href="https://tools.ietf.org/html/rfc7231#section-7.1.2">
+ * RFC 7231 Section 7.1.2</a>.
+ *
+ * <p><strong>Note:</strong> While relative redirects are more efficient they
+ * may not work with reverse proxies under some configurations.
+ *
+ * @author Rob Winch
+ * @author Rossen Stoyanchev
+ * @since 4.3.10
+ */
+public class RelativeRedirectFilter extends OncePerRequestFilter {
+
+	private HttpStatus redirectStatus = HttpStatus.SEE_OTHER;
+
+
+	/**
+	 * Set the default HTTP Status to use for redirects.
+	 * <p>By default this is {@link HttpStatus#SEE_OTHER}.
+	 * @param status the 3xx redirect status to use
+	 */
+	public void setRedirectStatus(HttpStatus status) {
+		Assert.notNull(status, "Property 'redirectStatus' is required");
+		Assert.isTrue(status.is3xxRedirection(), "Not a redirect status code");
+		this.redirectStatus = status;
+	}
+
+	/**
+	 * Return the configured redirect status.
+	 */
+	public HttpStatus getRedirectStatus() {
+		return this.redirectStatus;
+	}
+
+
+	@Override
+	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+			FilterChain filterChain) throws ServletException, IOException {
+
+		response = RelativeRedirectResponseWrapper.wrapIfNecessary(response, this.redirectStatus);
+		filterChain.doFilter(request, response);
+	}
+
+}

spring-web/src/main/java/org/springframework/web/filter/RelativeRedirectResponseWrapper.java

@@ -0,0 +1,72 @@
+/*
+ * Copyright 2002-2017 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.web.filter;
+
+import java.io.IOException;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpServletResponseWrapper;
+
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.util.Assert;
+
+/**
+ * A response wrapper used for the implementation of
+ * {@link RelativeRedirectFilter} also shared with {@link ForwardedHeaderFilter}.
+ *
+ * @author Rossen Stoyanchev
+ * @since 4.3.10
+ */
+class RelativeRedirectResponseWrapper extends HttpServletResponseWrapper {
+
+	private final HttpStatus redirectStatus;
+
+
+	private RelativeRedirectResponseWrapper(HttpServletResponse response, HttpStatus redirectStatus) {
+		super(response);
+		Assert.notNull(redirectStatus, "'redirectStatus' is required");
+		this.redirectStatus = redirectStatus;
+	}
+
+
+	@Override
+	public void sendRedirect(String location) throws IOException {
+		setStatus(this.redirectStatus.value());
+		setHeader(HttpHeaders.LOCATION, location);
+	}
+
+
+	public static HttpServletResponse wrapIfNecessary(HttpServletResponse response,
+			HttpStatus redirectStatus) {
+
+		return (hasWrapper(response) ? response : new RelativeRedirectResponseWrapper(response, redirectStatus));
+	}
+
+	private static boolean hasWrapper(ServletResponse response) {
+		if (response instanceof RelativeRedirectResponseWrapper) {
+			return true;
+		}
+		while (response instanceof HttpServletResponseWrapper) {
+			response = ((HttpServletResponseWrapper) response).getResponse();
+			if (response instanceof RelativeRedirectResponseWrapper) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+}