Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove individual detection of forwarded headers

Browse Source 
This commit removes all places where forwarded headers are checked
implicitly, on an ad-hoc basis.

ForwardedHeaderFilter is expected to be used instead providing
centralized control over using or discarding such headers.

Issue: SPR-16668
This commit is contained in:
Rossen Stoyanchev
2018-05-11 09:31:39 -04:00
parent 82a8e42ff9
commit 4da43de7e1
14 changed files with 251 additions and 299 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
spring-webflux/src/main/java/org/springframework/web/reactive/function/server/DefaultServerRequest.java
View File

@@ -36,7 +36,6 @@ import org.springframework.core.ParameterizedTypeReference;
import org.springframework.http.HttpCookie;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpRange;
import org.springframework.http.HttpRequest;
import org.springframework.http.MediaType;
import org.springframework.http.codec.HttpMessageReader;
import org.springframework.http.codec.multipart.Part;
@@ -93,7 +92,7 @@ class DefaultServerRequest implements ServerRequest {
@Override
public UriBuilder uriBuilder() {
return UriComponentsBuilder.fromHttpRequest(new ServerRequestAdapter());
return UriComponentsBuilder.fromUri(uri());
}
@Override
@@ -279,23 +278,4 @@ class DefaultServerRequest implements ServerRequest {
}
}
private final class ServerRequestAdapter implements HttpRequest {
@Override
public String getMethodValue() {
return methodName();
}
@Override
public URI getURI() {
return uri();
}
@Override
public HttpHeaders getHeaders() {
return request().getHeaders();
}
}
}

11
spring-webflux/src/main/java/org/springframework/web/reactive/function/server/ServerRequest.java
View File

@@ -84,10 +84,13 @@ public interface ServerRequest {
/**
* Return a {@code UriBuilderComponents} from the URI associated with this
* {@code ServerRequest}, while also overlaying with values from the headers
* "Forwarded" (<a href="http://tools.ietf.org/html/rfc7239">RFC 7239</a>),
* or "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" if
* "Forwarded" is not found.
* {@code ServerRequest}.
*
* <p><strong>Note:</strong> as of 5.1 this method ignores
* {@code "Forwarded"} and {@code "X-Forwarded-*"} headers that specify the
* client-originated address. Consider using the {@code ForwardedHeaderFilter}
* to extract and use, or to discard such headers.
*
* @return a URI builder
*/
UriBuilder uriBuilder();

2
spring-webflux/src/main/java/org/springframework/web/reactive/result/method/annotation/ServerWebExchangeArgumentResolver.java
View File

@@ -109,7 +109,7 @@ public class ServerWebExchangeArgumentResolver extends HandlerMethodArgumentReso
return timeZone != null ? timeZone.toZoneId() : ZoneId.systemDefault();
}
else if (UriBuilder.class == paramType || UriComponentsBuilder.class == paramType) {
return UriComponentsBuilder.fromHttpRequest(exchange.getRequest());
return UriComponentsBuilder.fromUri(exchange.getRequest().getURI());
}
else {
// should never happen...

22
spring-webflux/src/test/java/org/springframework/web/reactive/function/server/MockServerRequest.java
View File

@@ -38,7 +38,6 @@ import org.springframework.http.HttpCookie;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpRange;
import org.springframework.http.HttpRequest;
import org.springframework.http.MediaType;
import org.springframework.http.codec.HttpMessageReader;
import org.springframework.http.codec.multipart.Part;
@@ -139,7 +138,7 @@ public class MockServerRequest implements ServerRequest {
@Override
public UriBuilder uriBuilder() {
return UriComponentsBuilder.fromHttpRequest(new ServerRequestAdapter());
return UriComponentsBuilder.fromUri(this.uri);
}
@Override
@@ -569,23 +568,4 @@ public class MockServerRequest implements ServerRequest {
}
private final class ServerRequestAdapter implements HttpRequest {
@Override
public String getMethodValue() {
return methodName();
}
@Override
public URI getURI() {
return MockServerRequest.this.uri;
}
@Override
public HttpHeaders getHeaders() {
return MockServerRequest.this.headers.headers;
}
}
}