org.springframework.web.server.adapter

## Class ForwardedHeaderTransformer

- java.lang.Object
- - org.springframework.web.server.adapter.ForwardedHeaderTransformer

- All Implemented Interfaces:
    Function<ServerHttpRequest,ServerHttpRequest>
  Direct Known Subclasses:
    ForwardedHeaderFilter

      public class ForwardedHeaderTransformer
      extends Object
      implements Function<ServerHttpRequest,ServerHttpRequest>

  Extract values from "Forwarded" and "X-Forwarded-*" headers to override the request URI (i.e. `HttpRequest.getURI()`) so it reflects the client-originated protocol and address.

  An instance of this class is typically declared as a bean with the name "forwardedHeaderTransformer" and detected by `WebHttpHandlerBuilder.applicationContext(ApplicationContext)`, or it can also be registered directly via `WebHttpHandlerBuilder.forwardedHeaderTransformer(ForwardedHeaderTransformer)`.

  There are security considerations for forwarded headers since an application cannot know if the headers were added by a proxy, as intended, or by a malicious client. This is why a proxy at the boundary of trust should be configured to remove untrusted Forwarded headers that come from the outside.

  You can also configure the ForwardedHeaderFilter with `removeOnly`, in which case it removes but does not use the headers.

  Since:
    5.1
  Author:
    Rossen Stoyanchev
  See Also:
    https://tools.ietf.org/html/rfc7239

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `ForwardedHeaderTransformer()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `ServerHttpRequest` | `apply(ServerHttpRequest request)` Apply and remove, or remove Forwarded type headers.
    `protected boolean` | `hasForwardedHeaders(ServerHttpRequest request)` Whether the request has any Forwarded headers.
    `boolean` | `isRemoveOnly()` Whether the "remove only" mode is on.
    `void` | `setRemoveOnly(boolean removeOnly)` Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface java.util.function.Function

      `andThen, compose, identity`

- - ### Constructor Detail

    - #### ForwardedHeaderTransformer

          public ForwardedHeaderTransformer()

  - ### Method Detail

    - #### setRemoveOnly

          public void setRemoveOnly(boolean removeOnly)

      Enable mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.
      Parameters:
        `removeOnly` - whether to discard and ignore forwarded headers

    - #### isRemoveOnly

          public boolean isRemoveOnly()

      Whether the "remove only" mode is on.
      See Also:
        `setRemoveOnly(boolean)`

    - #### apply

          public ServerHttpRequest apply(ServerHttpRequest request)

      Apply and remove, or remove Forwarded type headers.
      Specified by:
        `apply` in interface `Function<ServerHttpRequest,ServerHttpRequest>`
      Parameters:
        `request` - the request

    - #### hasForwardedHeaders

          protected boolean hasForwardedHeaders(ServerHttpRequest request)

      Whether the request has any Forwarded headers.
      Parameters:
        `request` - the request