Merge branch '4.2.x'

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/DefaultNettyHttpForwardedHeaderHandler.java

@@ -0,0 +1,137 @@
+/*
+ * Copyright 2013-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * Copyright (c) 2020-2023 VMware, Inc. or its affiliates, All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.cloud.gateway.config;
+
+import java.util.function.BiFunction;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import io.netty.handler.codec.http.HttpRequest;
+import reactor.netty.http.server.ConnectionInfo;
+import reactor.netty.transport.AddressUtils;
+
+import static reactor.netty.http.server.ConnectionInfo.getDefaultHostPort;
+
+/**
+ * Default implementation for handling {@code X-Forwarded}/{@code Forwarded} headers.
+ *
+ * @author Andrey Shlykov
+ * @since 0.9.12
+ */
+final class DefaultNettyHttpForwardedHeaderHandler implements BiFunction<ConnectionInfo, HttpRequest, ConnectionInfo> {
+
+	static final DefaultNettyHttpForwardedHeaderHandler INSTANCE = new DefaultNettyHttpForwardedHeaderHandler();
+
+	static final String FORWARDED_HEADER = "Forwarded";
+	static final String X_FORWARDED_IP_HEADER = "X-Forwarded-For";
+	static final String X_FORWARDED_HOST_HEADER = "X-Forwarded-Host";
+	static final String X_FORWARDED_PORT_HEADER = "X-Forwarded-Port";
+	static final String X_FORWARDED_PROTO_HEADER = "X-Forwarded-Proto";
+
+	static final Pattern FORWARDED_HOST_PATTERN = Pattern.compile("host=\"?([^;,\"]+)\"?");
+	static final Pattern FORWARDED_PROTO_PATTERN = Pattern.compile("proto=\"?([^;,\"]+)\"?");
+	static final Pattern FORWARDED_FOR_PATTERN = Pattern.compile("for=\"?([^;,\"]+)\"?");
+
+	/**
+	 * Specifies whether the Http Server applies a strict {@code Forwarded} header
+	 * validation. By default, it is enabled and strict validation is used.
+	 * @since 1.0.8
+	 * @deprecated The system property is used for backwards compatibility and will be
+	 * removed in version 1.2.0.
+	 */
+	@Deprecated
+	static final String FORWARDED_HEADER_VALIDATION = "reactor.netty.http.server.forwarded.strictValidation";
+	static final boolean DEFAULT_FORWARDED_HEADER_VALIDATION = Boolean
+		.parseBoolean(System.getProperty(FORWARDED_HEADER_VALIDATION, "true"));
+
+	@Override
+	public ConnectionInfo apply(ConnectionInfo connectionInfo, HttpRequest request) {
+		String forwardedHeader = request.headers().get(FORWARDED_HEADER);
+		if (forwardedHeader != null) {
+			return parseForwardedInfo(connectionInfo, forwardedHeader);
+		}
+		return parseXForwardedInfo(connectionInfo, request);
+	}
+
+	private ConnectionInfo parseForwardedInfo(ConnectionInfo connectionInfo, String forwardedHeader) {
+		String forwarded = forwardedHeader.split(",", 2)[0];
+		Matcher protoMatcher = FORWARDED_PROTO_PATTERN.matcher(forwarded);
+		if (protoMatcher.find()) {
+			connectionInfo = connectionInfo.withScheme(protoMatcher.group(1).trim());
+		}
+		Matcher hostMatcher = FORWARDED_HOST_PATTERN.matcher(forwarded);
+		if (hostMatcher.find()) {
+			connectionInfo = connectionInfo.withHostAddress(AddressUtils.parseAddress(hostMatcher.group(1),
+					getDefaultHostPort(connectionInfo.getScheme()), DEFAULT_FORWARDED_HEADER_VALIDATION));
+		}
+		Matcher forMatcher = FORWARDED_FOR_PATTERN.matcher(forwarded);
+		if (forMatcher.find()) {
+			connectionInfo = connectionInfo.withRemoteAddress(AddressUtils.parseAddress(forMatcher.group(1).trim(),
+					connectionInfo.getRemoteAddress().getPort(), DEFAULT_FORWARDED_HEADER_VALIDATION));
+		}
+		return connectionInfo;
+	}
+
+	private ConnectionInfo parseXForwardedInfo(ConnectionInfo connectionInfo, HttpRequest request) {
+		String ipHeader = request.headers().get(X_FORWARDED_IP_HEADER);
+		if (ipHeader != null) {
+			connectionInfo = connectionInfo.withRemoteAddress(
+					AddressUtils.parseAddress(ipHeader.split(",", 2)[0], connectionInfo.getRemoteAddress().getPort()));
+		}
+		String protoHeader = request.headers().get(X_FORWARDED_PROTO_HEADER);
+		if (protoHeader != null) {
+			connectionInfo = connectionInfo.withScheme(protoHeader.split(",", 2)[0].trim());
+		}
+		String hostHeader = request.headers().get(X_FORWARDED_HOST_HEADER);
+		if (hostHeader != null) {
+			connectionInfo = connectionInfo
+				.withHostAddress(AddressUtils.parseAddress(hostHeader.split(",", 2)[0].trim(),
+						getDefaultHostPort(connectionInfo.getScheme()), DEFAULT_FORWARDED_HEADER_VALIDATION));
+		}
+
+		String portHeader = request.headers().get(X_FORWARDED_PORT_HEADER);
+		if (portHeader != null && !portHeader.isEmpty()) {
+			String portStr = portHeader.split(",", 2)[0].trim();
+			if (portStr.chars().allMatch(Character::isDigit)) {
+				int port = Integer.parseInt(portStr);
+				connectionInfo = connectionInfo.withHostAddress(
+						AddressUtils.createUnresolved(connectionInfo.getHostAddress().getHostString(), port),
+						connectionInfo.getHostName(), port);
+			}
+			else if (DEFAULT_FORWARDED_HEADER_VALIDATION) {
+				throw new IllegalArgumentException("Failed to parse a port from " + portHeader);
+			}
+		}
+		return connectionInfo;
+	}
+
+}

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayAutoConfiguration.java

@@ -17,6 +17,7 @@
 package org.springframework.cloud.gateway.config;
 
 import java.io.IOException;
+import java.net.InetSocketAddress;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
@@ -62,6 +63,7 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.boot.context.properties.PropertyMapper;
 import org.springframework.boot.ssl.SslBundles;
 import org.springframework.boot.web.embedded.netty.NettyReactiveWebServerFactory;
+import org.springframework.boot.web.embedded.netty.NettyServerCustomizer;
 import org.springframework.cloud.gateway.actuate.GatewayControllerEndpoint;
 import org.springframework.cloud.gateway.actuate.GatewayLegacyControllerEndpoint;
 import org.springframework.cloud.gateway.config.conditional.ConditionalOnEnabledFilter;
@@ -127,6 +129,7 @@ import org.springframework.cloud.gateway.filter.headers.GRPCResponseHeadersFilte
 import org.springframework.cloud.gateway.filter.headers.HttpHeadersFilter;
 import org.springframework.cloud.gateway.filter.headers.RemoveHopByHopHeadersFilter;
 import org.springframework.cloud.gateway.filter.headers.TransferEncodingNormalizationHeadersFilter;
+import org.springframework.cloud.gateway.filter.headers.TrustedProxies;
 import org.springframework.cloud.gateway.filter.headers.XForwardedHeadersFilter;
 import org.springframework.cloud.gateway.filter.ratelimit.Bucket4jRateLimiter;
 import org.springframework.cloud.gateway.filter.ratelimit.KeyResolver;
@@ -319,11 +322,11 @@ public class GatewayAutoConfiguration {
 	}
 
 	@Bean
-	@ConditionalOnProperty(name = "spring.cloud.gateway.server.webflux.forwarded.enabled", matchIfMissing = true)
-	public ForwardedHeadersFilter forwardedHeadersFilter(Environment env, ServerProperties serverProperties) {
+	@Conditional(TrustedProxies.ForwardedTrustedProxiesCondition.class)
+	public ForwardedHeadersFilter forwardedHeadersFilter(Environment env, ServerProperties serverProperties, GatewayProperties properties) {
 		boolean forwardedByEnabled = env.getProperty("spring.cloud.gateway.server.webflux.forwarded.by.enabled",
 				Boolean.class, false);
-		ForwardedHeadersFilter forwardedHeadersFilter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter forwardedHeadersFilter = new ForwardedHeadersFilter(properties.getTrustedProxies());
 		forwardedHeadersFilter.setForwardedByEnabled(forwardedByEnabled);
 		forwardedHeadersFilter.setServerPort(serverProperties.getPort());
 		return forwardedHeadersFilter;
@@ -337,9 +340,9 @@ public class GatewayAutoConfiguration {
 	}
 
 	@Bean
-	@ConditionalOnProperty(name = "spring.cloud.gateway.server.webflux.x-forwarded.enabled", matchIfMissing = true)
-	public XForwardedHeadersFilter xForwardedHeadersFilter() {
-		return new XForwardedHeadersFilter();
+	@Conditional(TrustedProxies.XForwardedTrustedProxiesCondition.class)
+	public XForwardedHeadersFilter xForwardedHeadersFilter(GatewayProperties properties) {
+		return new XForwardedHeadersFilter(properties.getTrustedProxies());
 	}
 
 	@Bean
@@ -790,6 +793,21 @@ public class GatewayAutoConfiguration {
 			};
 		}
 
+		@Bean
+		@TrustedProxies.ConditionalOnPropertyExists
+		public NettyServerCustomizer gatewayNettyServerCustomizer(GatewayProperties gatewayProperties) {
+			TrustedProxies trustedProxies = TrustedProxies.from(gatewayProperties.getTrustedProxies());
+
+			return httpServer -> httpServer.forwarded((connectionInfo, httpRequest) -> {
+				InetSocketAddress remoteAddress = connectionInfo.getRemoteAddress();
+				if (remoteAddress != null && trustedProxies.isTrusted(remoteAddress.getHostString())) {
+					// update remote address
+					return DefaultNettyHttpForwardedHeaderHandler.INSTANCE.apply(connectionInfo, httpRequest);
+				}
+				return connectionInfo;
+			});
+		}
+
 		@Bean
 		public HttpClientSslConfigurer httpClientSslConfigurer(ServerProperties serverProperties,
 				HttpClientProperties httpClientProperties, SslBundles bundles) {

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/config/GatewayProperties.java

@@ -73,6 +73,12 @@ public class GatewayProperties {
 	 */
 	private boolean routeFilterCacheEnabled = false;
 
+	/**
+	 * Regular expression defining proxies that are trusted when they appear in a
+	 * Forwarded or X-Forwarded header.
+	 */
+	private String trustedProxies;
+
 	public boolean isRouteFilterCacheEnabled() {
 		return routeFilterCacheEnabled;
 	}
@@ -116,6 +122,14 @@ public class GatewayProperties {
 		this.failOnRouteDefinitionError = failOnRouteDefinitionError;
 	}
 
+	public String getTrustedProxies() {
+		return trustedProxies;
+	}
+
+	public void setTrustedProxies(String trustedProxies) {
+		this.trustedProxies = trustedProxies;
+	}
+
 	@Override
 	public String toString() {
 		return new ToStringCreator(this).append("routes", routes)
@@ -123,6 +137,7 @@ public class GatewayProperties {
 			.append("streamingMediaTypes", streamingMediaTypes)
 			.append("failOnRouteDefinitionError", failOnRouteDefinitionError)
 			.append("routeFilterCacheEnabled", routeFilterCacheEnabled)
+			.append("trustedProxies", trustedProxies)
 			.toString();
 
 	}

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/headers/ForwardedHeadersFilter.java

@@ -29,7 +29,9 @@ import java.util.Map;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+import org.springframework.cloud.gateway.config.GatewayProperties;
 import org.springframework.core.Ordered;
+import org.springframework.core.log.LogMessage;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.util.CollectionUtils;
@@ -44,6 +46,8 @@ import org.springframework.web.server.ServerWebExchange;
  */
 public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 
+	private static final Log log = LogFactory.getLog(ForwardedHeadersFilter.class);
+
 	private Integer serverPort;
 
 	private final Log logger = LogFactory.getLog(getClass());
@@ -55,6 +59,19 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 	 */
 	public static final String FORWARDED_HEADER = "Forwarded";
 
+	private final TrustedProxies trustedProxies;
+
+	@Deprecated
+	public ForwardedHeadersFilter() {
+		trustedProxies = s -> true;
+		log.warn(GatewayProperties.PREFIX
+				+ ".trusted-proxies is not set. Using deprecated Constructor. Untrusted hosts might be added to Forwarded header.");
+	}
+
+	public ForwardedHeadersFilter(String trustedProxiesRegex) {
+		trustedProxies = TrustedProxies.from(trustedProxiesRegex);
+	}
+
 	/* for testing */
 	static List<Forwarded> parse(List<String> values) {
 		ArrayList<Forwarded> forwardeds = new ArrayList<>();
@@ -62,8 +79,11 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 			return forwardeds;
 		}
 		for (String value : values) {
-			Forwarded forwarded = parse(value);
-			forwardeds.add(forwarded);
+			String[] forwardedValues = StringUtils.tokenizeToStringArray(value, ",");
+			for (String forwardedValue : forwardedValues) {
+				Forwarded forwarded = parse(forwardedValue);
+				forwardeds.add(forwarded);
+			}
 		}
 		return forwardeds;
 	}
@@ -114,6 +134,14 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 	@Override
 	public HttpHeaders filter(HttpHeaders input, ServerWebExchange exchange) {
 		ServerHttpRequest request = exchange.getRequest();
+
+		if (request.getRemoteAddress() != null
+				&& !trustedProxies.isTrusted(request.getRemoteAddress().getHostString())) {
+			log.trace(LogMessage.format("Remote address not trusted. pattern %s remote address %s", trustedProxies,
+					request.getRemoteAddress()));
+			return input;
+		}
+
 		HttpHeaders original = input;
 		HttpHeaders updated = new HttpHeaders();
 
@@ -127,7 +155,10 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 		List<Forwarded> forwardeds = parse(original.get(FORWARDED_HEADER));
 
 		for (Forwarded f : forwardeds) {
-			updated.add(FORWARDED_HEADER, f.toHeaderValue());
+			// only add if "for" value matches trustedProxies
+			if (trustedProxies.isTrusted(f.get("for"))) {
+				updated.add(FORWARDED_HEADER, f.toHeaderValue());
+			}
 		}
 
 		// TODO: add new forwarded
@@ -136,6 +167,7 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 		Forwarded forwarded = new Forwarded().put("host", host).put("proto", uri.getScheme());
 
 		InetSocketAddress remoteAddress = request.getRemoteAddress();
+		// TODO: only add if "remoteAddress" value matches trustedProxies
 		if (remoteAddress != null) {
 			// If remoteAddress is unresolved, calling getHostAddress() would cause a
 			// NullPointerException.
@@ -150,11 +182,14 @@ public class ForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 					forValue = "[" + forValue + "]";
 				}
 			}
-			int port = remoteAddress.getPort();
-			if (port >= 0) {
-				forValue = forValue + ":" + port;
+			if (trustedProxies.isTrusted(forValue)) {
+				// only add for value if trusted
+				int port = remoteAddress.getPort();
+				if (port >= 0) {
+					forValue = forValue + ":" + port;
+				}
+				forwarded.put("for", forValue);
 			}
-			forwarded.put("for", forValue);
 		}
 
 		if (forwardedByEnabled) {

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/headers/TrustedProxies.java

@@ -0,0 +1,117 @@
+/*
+ * Copyright 2013-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.cloud.gateway.filter.headers;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import java.util.NoSuchElementException;
+import java.util.regex.Pattern;
+
+import org.springframework.boot.autoconfigure.condition.AllNestedConditions;
+import org.springframework.boot.autoconfigure.condition.ConditionOutcome;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.condition.SpringBootCondition;
+import org.springframework.cloud.gateway.config.GatewayProperties;
+import org.springframework.context.annotation.ConditionContext;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.core.type.AnnotatedTypeMetadata;
+import org.springframework.lang.NonNull;
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
+@FunctionalInterface
+public interface TrustedProxies {
+
+	/**
+	 * Property name.
+	 */
+	String PROPERTY = GatewayProperties.PREFIX + ".trusted-proxies";
+
+	boolean isTrusted(String host);
+
+	static TrustedProxies from(@NonNull String trustedProxies) {
+		Assert.hasText(trustedProxies, "trustedProxies must not be empty");
+		Pattern pattern = Pattern.compile(trustedProxies);
+		return value -> pattern.matcher(value).matches();
+	}
+
+	class ForwardedTrustedProxiesCondition extends AllNestedConditions {
+
+		public ForwardedTrustedProxiesCondition() {
+			super(ConfigurationPhase.REGISTER_BEAN);
+		}
+
+		@ConditionalOnProperty(name = GatewayProperties.PREFIX + ".forwarded.enabled", matchIfMissing = true)
+		static class OnPropertyEnabled {
+
+		}
+
+		@ConditionalOnPropertyExists
+		static class OnTrustedProxiesNotEmpty {
+
+		}
+
+	}
+
+	class XForwardedTrustedProxiesCondition extends AllNestedConditions {
+
+		public XForwardedTrustedProxiesCondition() {
+			super(ConfigurationPhase.REGISTER_BEAN);
+		}
+
+		@ConditionalOnProperty(name = GatewayProperties.PREFIX + ".x-forwarded.enabled", matchIfMissing = true)
+		static class OnPropertyEnabled {
+
+		}
+
+		@ConditionalOnPropertyExists
+		static class OnTrustedProxiesNotEmpty {
+
+		}
+
+	}
+
+	class OnPropertyExistsCondition extends SpringBootCondition {
+
+		@Override
+		public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) {
+			try {
+				String property = context.getEnvironment().getProperty(PROPERTY);
+				if (!StringUtils.hasText(property)) {
+					return ConditionOutcome.noMatch(PROPERTY + " property is not set or is empty.");
+				}
+				return ConditionOutcome.match(PROPERTY + " property is not empty.");
+			}
+			catch (NoSuchElementException e) {
+				return ConditionOutcome.noMatch("Missing required property 'value' of @ConditionalOnPropertyExists");
+			}
+		}
+
+	}
+
+	@Retention(RetentionPolicy.RUNTIME)
+	@Target({ ElementType.TYPE, ElementType.METHOD })
+	@Documented
+	@Conditional(OnPropertyExistsCondition.class)
+	@interface ConditionalOnPropertyExists {
+
+	}
+
+}

spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/headers/XForwardedHeadersFilter.java

@@ -20,9 +20,15 @@ import java.net.URI;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Predicate;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.cloud.gateway.config.GatewayProperties;
 import org.springframework.core.Ordered;
+import org.springframework.core.log.LogMessage;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.util.ObjectUtils;
@@ -35,6 +41,8 @@ import static org.springframework.cloud.gateway.support.ServerWebExchangeUtils.G
 @ConfigurationProperties("spring.cloud.gateway.server.webflux.x-forwarded")
 public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 
+	private static final Log log = LogFactory.getLog(XForwardedHeadersFilter.class);
+
 	/** Default http port. */
 	public static final int HTTP_PORT = 80;
 
@@ -98,6 +106,19 @@ public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 	/** If appending X-Forwarded-Prefix as a list is enabled. */
 	private boolean prefixAppend = true;
 
+	private final TrustedProxies trustedProxies;
+
+	@Deprecated
+	public XForwardedHeadersFilter() {
+		trustedProxies = s -> true;
+		log.warn(GatewayProperties.PREFIX
+				+ ".trusted-proxies is not set. Using deprecated Constructor. Untrusted hosts might be added to Forwarded header.");
+	}
+
+	public XForwardedHeadersFilter(String trustedProxiesRegex) {
+		trustedProxies = TrustedProxies.from(trustedProxiesRegex);
+	}
+
 	@Override
 	public int getOrder() {
 		return this.order;
@@ -197,8 +218,15 @@ public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 
 	@Override
 	public HttpHeaders filter(HttpHeaders input, ServerWebExchange exchange) {
-
 		ServerHttpRequest request = exchange.getRequest();
+
+		if (request.getRemoteAddress() != null
+				&& !trustedProxies.isTrusted(request.getRemoteAddress().getHostString())) {
+			log.trace(LogMessage.format("Remote address not trusted. pattern %s remote address %s", trustedProxies,
+					request.getRemoteAddress()));
+			return input;
+		}
+
 		HttpHeaders original = input;
 		HttpHeaders updated = new HttpHeaders();
 
@@ -206,9 +234,13 @@ public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 			updated.addAll(entry.getKey(), entry.getValue());
 		}
 
-		if (isForEnabled() && request.getRemoteAddress() != null && request.getRemoteAddress().getAddress() != null) {
-			String remoteAddr = request.getRemoteAddress().getAddress().getHostAddress();
-			write(updated, X_FORWARDED_FOR_HEADER, remoteAddr, isForAppend());
+		if (isForEnabled()) {
+			String remoteAddr = null;
+			if (request.getRemoteAddress() != null && request.getRemoteAddress().getAddress() != null) {
+				remoteAddr = request.getRemoteAddress().getHostString();
+			}
+			// match xforwarded for against trusted proxies
+			write(updated, X_FORWARDED_FOR_HEADER, remoteAddr, isForAppend(), trustedProxies::isTrusted);
 		}
 
 		String proto = request.getURI().getScheme();
@@ -284,17 +316,22 @@ public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 	}
 
 	private void write(HttpHeaders headers, String name, String value, boolean append) {
-		if (value == null) {
-			return;
-		}
+		write(headers, name, value, append, s -> true);
+	}
+
+	private void write(HttpHeaders headers, String name, String value, boolean append, Predicate<String> shouldWrite) {
 		if (append) {
-			headers.add(name, value);
+			if (value != null) {
+				headers.add(name, value);
+			}
 			// these headers should be treated as a single comma separated header
-			List<String> values = headers.get(name);
-			String delimitedValue = StringUtils.collectionToCommaDelimitedString(values);
-			headers.set(name, delimitedValue);
+			if (headers.containsKey(name)) {
+				List<String> values = headers.get(name).stream().filter(shouldWrite).toList();
+				String delimitedValue = StringUtils.collectionToCommaDelimitedString(values);
+				headers.set(name, delimitedValue);
+			}
 		}
-		else {
+		else if (value != null && shouldWrite.test(value)) {
 			headers.set(name, value);
 		}
 	}
@@ -303,11 +340,6 @@ public class XForwardedHeadersFilter implements HttpHeadersFilter, Ordered {
 		return HTTPS_SCHEME.equals(scheme) ? HTTPS_PORT : HTTP_PORT;
 	}
 
-	private boolean hasHeader(ServerHttpRequest request, String name) {
-		HttpHeaders headers = request.getHeaders();
-		return headers.containsKey(name) && StringUtils.hasLength(headers.getFirst(name));
-	}
-
 	private String toHostHeader(ServerHttpRequest request) {
 		int port = request.getURI().getPort();
 		String host = request.getURI().getHost();

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/config/GatewayAutoConfigurationTests.java

@@ -58,8 +58,10 @@ import org.springframework.cloud.gateway.actuate.GatewayLegacyControllerEndpoint
 import org.springframework.cloud.gateway.config.GatewayAutoConfigurationTests.CustomHttpClientFactory.CustomSslConfigurer;
 import org.springframework.cloud.gateway.config.HttpClientProperties.Pool.LeasingStrategy;
 import org.springframework.cloud.gateway.filter.factory.TokenRelayGatewayFilterFactory;
+import org.springframework.cloud.gateway.filter.headers.ForwardedHeadersFilter;
 import org.springframework.cloud.gateway.filter.headers.GRPCRequestHeadersFilter;
 import org.springframework.cloud.gateway.filter.headers.GRPCResponseHeadersFilter;
+import org.springframework.cloud.gateway.filter.headers.XForwardedHeadersFilter;
 import org.springframework.cloud.gateway.route.RouteLocator;
 import org.springframework.cloud.gateway.route.builder.GatewayFilterSpec;
 import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder;
@@ -206,8 +208,8 @@ public class GatewayAutoConfigurationTests {
 					"spring.security.oauth2.client.registration[test].redirect-uri=http://localhost/redirect",
 					"spring.security.oauth2.client.registration[test].client-id=login-client")
 			.run(context -> {
-				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientManager.class);
-				assertThat(context).hasSingleBean(TokenRelayGatewayFilterFactory.class);
+				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientManager.class)
+					.hasSingleBean(TokenRelayGatewayFilterFactory.class);
 			});
 	}
 
@@ -225,8 +227,8 @@ public class GatewayAutoConfigurationTests {
 					"spring.security.oauth2.client.registration[test].redirect-uri=http://localhost/redirect",
 					"spring.security.oauth2.client.registration[test].client-id=login-client")
 			.run(context -> {
-				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientManager.class);
-				assertThat(context).hasBean("myReactiveOAuth2AuthorizedClientManager");
+				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientManager.class)
+					.hasBean("myReactiveOAuth2AuthorizedClientManager");
 			});
 	}
 
@@ -290,8 +292,8 @@ public class GatewayAutoConfigurationTests {
 					HttpClientCustomizedConfig.class, ServerPropertiesConfig.class))
 			.withPropertyValues("server.http2.enabled=true")
 			.run(context -> {
-				assertThat(context).hasSingleBean(GRPCRequestHeadersFilter.class);
-				assertThat(context).hasSingleBean(GRPCResponseHeadersFilter.class);
+				assertThat(context).hasSingleBean(GRPCRequestHeadersFilter.class)
+					.hasSingleBean(GRPCResponseHeadersFilter.class);
 				HttpClient httpClient = context.getBean(HttpClient.class);
 				assertThat(httpClient.configuration().protocols()).contains(HttpProtocol.HTTP11, HttpProtocol.H2);
 			});
@@ -305,8 +307,8 @@ public class GatewayAutoConfigurationTests {
 					HttpClientCustomizedConfig.class, ServerPropertiesConfig.class))
 			.withPropertyValues("server.http2.enabled=false")
 			.run(context -> {
-				assertThat(context).doesNotHaveBean(GRPCRequestHeadersFilter.class);
-				assertThat(context).doesNotHaveBean(GRPCResponseHeadersFilter.class);
+				assertThat(context).doesNotHaveBean(GRPCRequestHeadersFilter.class)
+					.doesNotHaveBean(GRPCResponseHeadersFilter.class);
 			});
 	}
 
@@ -337,6 +339,32 @@ public class GatewayAutoConfigurationTests {
 			});
 	}
 
+	@Test
+	public void forwardedHeaderFiltersNotEnabledByDefault() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, MetricsAutoConfiguration.class,
+					SimpleMetricsExportAutoConfiguration.class, GatewayAutoConfiguration.class,
+					ServerPropertiesConfig.class))
+			.run(context -> {
+				assertThat(context).doesNotHaveBean(XForwardedHeadersFilter.class)
+					.doesNotHaveBean(ForwardedHeadersFilter.class);
+			});
+	}
+
+	@Test
+	public void forwardedHeaderFiltersEnabledWithProperties() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, MetricsAutoConfiguration.class,
+					SimpleMetricsExportAutoConfiguration.class, GatewayAutoConfiguration.class,
+					ServerPropertiesConfig.class))
+			.withPropertyValues("spring.cloud.gateway.forwarded.enabled=true",
+					"spring.cloud.gateway.x-forwarded.enabled=true", "spring.cloud.gateway.trusted-proxies=.*")
+			.run(context -> {
+				assertThat(context).hasSingleBean(XForwardedHeadersFilter.class)
+					.hasSingleBean(ForwardedHeadersFilter.class);
+			});
+	}
+
 	@Configuration
 	@EnableConfigurationProperties(ServerProperties.class)
 	@AutoConfigureBefore(GatewayAutoConfiguration.class)

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/factory/RetryGatewayFilterFactoryIntegrationTests.java

@@ -66,7 +66,8 @@ import static org.springframework.boot.test.context.SpringBootTest.WebEnvironmen
 @SpringBootTest(webEnvironment = RANDOM_PORT,
 		properties = { "spring.cloud.gateway.server.webflux.httpclient.connect-timeout=500",
 				"spring.cloud.gateway.server.webflux.httpclient.response-timeout=2s",
-				"logging.level.org.springframework.cloud.gateway.filter.factory.RetryGatewayFilterFactory=TRACE" })
+				"logging.level.org.springframework.cloud.gateway.filter.factory.RetryGatewayFilterFactory=TRACE"
+				"spring.cloud.gateway.server.webflux.trusted-proxies=.*", "spring.cloud.gateway.server.webflux.x-forwarded.enabled=true" })
 @DirtiesContext
 // default filter AddResponseHeader suppresses bug
 // https://github.com/spring-cloud/spring-cloud-gateway/issues/1315,

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/headers/ForwardedHeadersFilterTests.java

@@ -24,10 +24,17 @@ import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.assertj.core.api.Assertions;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.autoconfigure.ssl.SslAutoConfiguration;
+import org.springframework.boot.autoconfigure.web.reactive.ReactiveWebServerFactoryAutoConfiguration;
+import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration;
+import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
+import org.springframework.cloud.gateway.config.GatewayAutoConfiguration;
 import org.springframework.cloud.gateway.filter.headers.ForwardedHeadersFilter.Forwarded;
 import org.springframework.http.HttpHeaders;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
@@ -60,7 +67,7 @@ public class ForwardedHeadersFilterTests {
 			.header(HttpHeaders.HOST, "myhost")
 			.build();
 
-		ForwardedHeadersFilter filter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -80,26 +87,37 @@ public class ForwardedHeadersFilterTests {
 	public void forwardedHeaderExists() throws UnknownHostException {
 		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost/get")
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
-			.header(FORWARDED_HEADER, "for=12.34.56.78;host=example.com;proto=https; for=23.45.67.89")
+			.header(FORWARDED_HEADER, "for=12.34.56.78;host=example.com;proto=https, for=23.45.67.89")
 			.build();
 
-		ForwardedHeadersFilter filter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
-		assertThat(headers.get(FORWARDED_HEADER)).hasSize(2);
+		assertThat(headers.get(FORWARDED_HEADER)).hasSize(3);
 
 		List<Forwarded> forwardeds = ForwardedHeadersFilter.parse(headers.get(FORWARDED_HEADER));
 
-		assertThat(forwardeds).hasSize(2);
-		Forwarded addedForwardedHeader = forwardeds.get(0);
-		Forwarded existingForwardedHeader = forwardeds.get(1);
-
-		assertThat(existingForwardedHeader.getValues()).containsEntry("proto", "http")
-			.containsEntry("for", "\"10.0.0.1:80\"");
-
-		assertThat(addedForwardedHeader.getValues()).containsEntry("proto", "https")
-			.containsEntry("for", "23.45.67.89");
+		assertThat(forwardeds).hasSize(3);
+		Optional<Forwarded> added = forwardeds.stream()
+			.filter(forwarded -> forwarded.get("for").contains("10.0.0.1:80"))
+			.findFirst();
+		assertThat(added).isPresent();
+		added.ifPresent(forwarded -> {
+			assertThat(forwarded.getValues()).containsEntry("proto", "http").containsEntry("for", "\"10.0.0.1:80\"");
+		});
+		Optional<Forwarded> existing = forwardeds.stream()
+			.filter(forwarded -> forwarded.get("for").equals("23.45.67.89"))
+			.findFirst();
+		assertThat(existing).isPresent();
+		existing.ifPresent(forwarded -> {
+			assertThat(forwarded.getValues()).containsEntry("for", "23.45.67.89");
+		});
+		existing = forwardeds.stream().filter(forwarded -> forwarded.get("for").equals("12.34.56.78")).findFirst();
+		assertThat(existing).isPresent();
+		existing.ifPresent(forwarded -> {
+			assertThat(forwarded.getValues()).containsEntry("proto", "https").containsEntry("for", "12.34.56.78");
+		});
 	}
 
 	@Test
@@ -108,7 +126,7 @@ public class ForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		ForwardedHeadersFilter filter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -129,7 +147,7 @@ public class ForwardedHeadersFilterTests {
 			.header(HttpHeaders.HOST, "myhost")
 			.build();
 
-		ForwardedHeadersFilter filter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -149,7 +167,7 @@ public class ForwardedHeadersFilterTests {
 			.remoteAddress(InetSocketAddress.createUnresolved("unresolvable-hostname", 80))
 			.build();
 
-		ForwardedHeadersFilter filter = new ForwardedHeadersFilter();
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -241,4 +259,83 @@ public class ForwardedHeadersFilterTests {
 		Assertions.assertThat(forwarded.getValues()).containsEntry("by", "216.103.69.111");
 	}
 
+	@Test
+	public void trustedProxiesConditionMatches() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, SslAutoConfiguration.class,
+					ReactiveWebServerFactoryAutoConfiguration.class, GatewayAutoConfiguration.class))
+			.withPropertyValues("spring.cloud.gateway.trusted-proxies=11\\.0\\.0\\..*")
+			.run(context -> {
+				assertThat(context).hasSingleBean(ForwardedHeadersFilter.class);
+			});
+	}
+
+	@Test
+	public void trustedProxiesConditionDoesNotMatch() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, SslAutoConfiguration.class,
+					ReactiveWebServerFactoryAutoConfiguration.class, GatewayAutoConfiguration.class))
+			.run(context -> {
+				assertThat(context).doesNotHaveBean(ForwardedHeadersFilter.class);
+			});
+	}
+
+	@Test
+	public void emptyTrustedProxiesFails() {
+		Assertions.assertThatThrownBy(() -> new ForwardedHeadersFilter(""))
+			.isInstanceOf(IllegalArgumentException.class);
+	}
+
+	@Test
+	public void forwardedHeadersNotTrusted() throws Exception {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost/get")
+			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
+			.header(HttpHeaders.HOST, "myhost")
+			.build();
+
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter("11\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).doesNotContainKeys(FORWARDED_HEADER);
+	}
+
+	// verify that existing forwarded header is not forwarded if not trusted
+	@Test
+	public void untrustedForwardedForNotAppended() throws Exception {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost/get")
+			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
+			.header(HttpHeaders.HOST, "myhost")
+			.header(FORWARDED_HEADER, "proto=http;host=myhost;for=\"127.0.0.1:80\",for=10.0.0.11")
+			.build();
+
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter("10\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).containsKeys(FORWARDED_HEADER);
+		List<String> forwardedHeaders = headers.get(FORWARDED_HEADER);
+		Optional<String> filtered = forwardedHeaders.stream().filter(value -> value.contains("127.0.0.1")).findFirst();
+		assertThat(filtered).isEmpty();
+		filtered = forwardedHeaders.stream().filter(value -> value.contains("10.0.0.11")).findFirst();
+		assertThat(filtered).isNotEmpty();
+	}
+
+	@Test
+	public void remoteAdddressIsNullUnTrustedProxyNotAppended() throws Exception {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost:8080/get")
+			.header(HttpHeaders.HOST, "myhost")
+			.header(FORWARDED_HEADER, "proto=http;host=myhost;for=127.0.0.1")
+			.build();
+
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter("10\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).containsKeys(FORWARDED_HEADER);
+		List<String> forwardedHeaders = headers.get(FORWARDED_HEADER);
+		Optional<String> filtered = forwardedHeaders.stream().filter(value -> value.contains("127.0.0.1")).findFirst();
+		assertThat(filtered).isEmpty();
+	}
+
 }

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/headers/XForwardedHeadersFilterTests.java

@@ -21,8 +21,16 @@ import java.net.InetSocketAddress;
 import java.net.URI;
 import java.util.LinkedHashSet;
 
+import org.assertj.core.api.Assertions;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.autoconfigure.ssl.SslAutoConfiguration;
+import org.springframework.boot.autoconfigure.web.reactive.ReactiveWebServerFactoryAutoConfiguration;
+import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration;
+import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
+import org.springframework.cloud.gateway.config.GatewayAutoConfiguration;
+import org.springframework.cloud.gateway.config.GatewayProperties;
 import org.springframework.http.HttpHeaders;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
@@ -43,17 +51,20 @@ import static org.springframework.cloud.gateway.support.ServerWebExchangeUtils.G
  */
 public class XForwardedHeadersFilterTests {
 
+	public static final String ALLOW_ALL_REGEX = ".*";
+
 	@Test
 	public void remoteAddressIsNull() {
 		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost:8080/get")
 			.header(HttpHeaders.HOST, "myhost")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
-		assertThat(headers).containsKeys(X_FORWARDED_HOST_HEADER, X_FORWARDED_PORT_HEADER, X_FORWARDED_PROTO_HEADER);
+		assertThat(headers).doesNotContainKeys(X_FORWARDED_FOR_HEADER)
+			.containsKeys(X_FORWARDED_HOST_HEADER, X_FORWARDED_PORT_HEADER, X_FORWARDED_PROTO_HEADER);
 
 		assertThat(headers.getFirst(X_FORWARDED_HOST_HEADER)).isEqualTo("localhost:8080");
 		assertThat(headers.getFirst(X_FORWARDED_PORT_HEADER)).isEqualTo("8080");
@@ -67,7 +78,7 @@ public class XForwardedHeadersFilterTests {
 			.header(HttpHeaders.HOST, "myhost")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -87,7 +98,7 @@ public class XForwardedHeadersFilterTests {
 			.header(HttpHeaders.HOST, "myhost")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -110,7 +121,7 @@ public class XForwardedHeadersFilterTests {
 			.header(X_FORWARDED_PROTO_HEADER, "https")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -134,7 +145,7 @@ public class XForwardedHeadersFilterTests {
 			.header(X_FORWARDED_PREFIX_HEADER, "/prefix")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setForAppend(false);
 		filter.setHostAppend(false);
 		filter.setPortAppend(false);
@@ -159,7 +170,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setPrefixAppend(true);
 		filter.setPrefixEnabled(true);
 
@@ -184,7 +195,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setPrefixAppend(true);
 		filter.setPrefixEnabled(true);
 
@@ -210,7 +221,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setPrefixAppend(true);
 		filter.setPrefixEnabled(true);
 
@@ -232,7 +243,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setPrefixAppend(true);
 		filter.setPrefixEnabled(true);
 		filter.setForEnabled(false);
@@ -258,7 +269,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setPrefixAppend(true);
 		filter.setPrefixEnabled(true);
 		filter.setForEnabled(false);
@@ -284,7 +295,7 @@ public class XForwardedHeadersFilterTests {
 			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 		filter.setForEnabled(false);
 		filter.setHostEnabled(false);
 		filter.setPortEnabled(false);
@@ -303,7 +314,7 @@ public class XForwardedHeadersFilterTests {
 			.header(X_FORWARDED_FOR_HEADER, "10.0.0.1")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
@@ -319,11 +330,92 @@ public class XForwardedHeadersFilterTests {
 			.header(X_FORWARDED_FOR_HEADER, "10.0.0.1")
 			.build();
 
-		XForwardedHeadersFilter filter = new XForwardedHeadersFilter();
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter(ALLOW_ALL_REGEX);
 
 		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
 
 		assertThat(headers).doesNotContainKeys(X_FORWARDED_PROTO_HEADER, X_FORWARDED_HOST_HEADER);
 	}
 
+	@Test
+	public void trustedProxiesConditionMatches() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, SslAutoConfiguration.class,
+					ReactiveWebServerFactoryAutoConfiguration.class, GatewayAutoConfiguration.class))
+			.withPropertyValues(GatewayProperties.PREFIX + ".trusted-proxies=11\\.0\\.0\\..*")
+			.run(context -> {
+				assertThat(context).hasSingleBean(XForwardedHeadersFilter.class);
+			});
+	}
+
+	@Test
+	public void trustedProxiesConditionDoesNotMatch() {
+		new ReactiveWebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class, SslAutoConfiguration.class,
+					ReactiveWebServerFactoryAutoConfiguration.class, GatewayAutoConfiguration.class))
+			.run(context -> {
+				assertThat(context).doesNotHaveBean(XForwardedHeadersFilter.class);
+			});
+	}
+
+	@Test
+	public void emptyTrustedProxiesFails() {
+		Assertions.assertThatThrownBy(() -> new XForwardedHeadersFilter(""))
+			.isInstanceOf(IllegalArgumentException.class);
+	}
+
+	@Test
+	public void xForwardedHeadersNotTrusted() throws Exception {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost:8080/get")
+			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
+			.header(HttpHeaders.HOST, "myhost")
+			.build();
+
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter("11\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).doesNotContainKeys(X_FORWARDED_FOR_HEADER, X_FORWARDED_HOST_HEADER, X_FORWARDED_PORT_HEADER,
+				X_FORWARDED_PROTO_HEADER);
+	}
+
+	// : verify that existing x-forwarded-* headers are not forwarded
+	// if x-forwarded-for is not trusted
+	@Test
+	public void untrustedXForwardedForNotAppended() throws Exception {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost:8080/get")
+			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
+			.header(HttpHeaders.HOST, "myhost")
+			.header(X_FORWARDED_FOR_HEADER, "127.0.0.1")
+			.header(X_FORWARDED_FOR_HEADER, "10.0.0.10")
+			.build();
+
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter("10\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).containsKeys(X_FORWARDED_FOR_HEADER, X_FORWARDED_HOST_HEADER, X_FORWARDED_PORT_HEADER,
+				X_FORWARDED_PROTO_HEADER);
+
+		assertThat(headers.getFirst(X_FORWARDED_FOR_HEADER)).doesNotContain("127.0.0.1")
+			.contains("10.0.0.1", "10.0.0.10");
+	}
+
+	@Test
+	public void remoteAdddressIsNullUnTrustedProxyNotAppended() {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost:8080/get")
+			.header(HttpHeaders.HOST, "myhost")
+			.header(X_FORWARDED_FOR_HEADER, "127.0.0.1")
+			.build();
+
+		XForwardedHeadersFilter filter = new XForwardedHeadersFilter("10\\.0\\.0\\..*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers).containsKeys(X_FORWARDED_FOR_HEADER, X_FORWARDED_HOST_HEADER, X_FORWARDED_PORT_HEADER,
+				X_FORWARDED_PROTO_HEADER);
+
+		assertThat(headers.getFirst(X_FORWARDED_FOR_HEADER)).doesNotContain("127.0.0.1");
+	}
+
 }

spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/test/GatewayIntegrationTests.java

@@ -63,7 +63,9 @@ import static org.springframework.boot.test.context.SpringBootTest.WebEnvironmen
 import static org.springframework.cloud.gateway.test.TestUtils.getMap;
 
 @SpringBootTest(webEnvironment = RANDOM_PORT,
-		properties = "spring.cloud.gateway.server.webflux.forwarded.by.enabled=true")
+		properties = { "spring.cloud.gateway.server.webflux.forwarded.by.enabled=true", "spring.cloud.gateway.server.webflux.forwarded.enabled=true", "spring.cloud.gateway.server.webflux.x-forwarded.enabled=true",
+				"spring.cloud.gateway.server.webflux.trusted-proxies=.*",
+				"logging.level.org.springframework.cloud.gateway.filter.headers=TRACE" })
 @DirtiesContext
 @SuppressWarnings("unchecked")
 @ExtendWith(OutputCaptureExtension.class)

spring-cloud-gateway-server/src/test/resources/application-remote-address.yml

@@ -22,3 +22,4 @@ spring:
         filters:
         - SetPath=/httpbin/
         - SetStatus=200
+      trusted-proxies: .*