org.springframework.web.filter

## Class ForwardedHeaderFilter

- java.lang.Object
- - org.springframework.web.filter.GenericFilterBean
  - - org.springframework.web.filter.OncePerRequestFilter
    - - org.springframework.web.filter.ForwardedHeaderFilter

- All Implemented Interfaces:
    Filter, Aware, BeanNameAware, DisposableBean, InitializingBean, EnvironmentAware, EnvironmentCapable, ServletContextAware

      public class ForwardedHeaderFilter
      extends OncePerRequestFilter

  Extract values from "Forwarded" and "X-Forwarded-*" headers, wrap the request and response, and make they reflect the client-originated protocol and address in the following methods:
  - `getServerName()`
  - `getServerPort()`
  - `getScheme()`
  - `isSecure()`
  - `sendRedirect(String)`.

  There are security considerations for forwarded headers since an application cannot know if the headers were added by a proxy, as intended, or by a malicious client. This is why a proxy at the boundary of trust should be configured to remove untrusted Forwarded headers that come from the outside.

  You can also configure the ForwardedHeaderFilter with `removeOnly`, in which case it removes but does not use the headers.

  Since:
    4.3
  Author:
    Rossen Stoyanchev, Eddú Meléndez, Rob Winch
  See Also:
    https://tools.ietf.org/html/rfc7239

- - ### Field Summary

    - ### Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

      `ALREADY_FILTERED_SUFFIX`

    - ### Fields inherited from class org.springframework.web.filter.GenericFilterBean

      `logger`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `ForwardedHeaderFilter()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `protected void` | `doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)` Same contract as for `doFilter`, but guaranteed to be just invoked once per request within a single request thread.
    `protected void` | `doFilterNestedErrorDispatch(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)` Typically an ERROR dispatch happens after the REQUEST dispatch completes, and the filter chain starts anew.
    `void` | `setRelativeRedirects(boolean relativeRedirects)` Use this property to enable relative redirects as explained in `RelativeRedirectFilter`, and also using the same response wrapper as that filter does, or if both are configured, only one will wrap.
    `void` | `setRemoveOnly(boolean removeOnly)` Enables mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.
    `protected boolean` | `shouldNotFilter(HttpServletRequest request)` Can be overridden in subclasses for custom filtering control, returning `true` to avoid filtering of the given request.
    `protected boolean` | `shouldNotFilterAsyncDispatch()` The dispatcher type `javax.servlet.DispatcherType.ASYNC` introduced in Servlet 3.0 means a filter can be invoked in more than one thread over the course of a single request.
    `protected boolean` | `shouldNotFilterErrorDispatch()` Whether to filter error dispatches such as when the servlet container processes and error mapped in `web.xml`.

    - ### Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

      `doFilter, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted`

    - ### Methods inherited from class org.springframework.web.filter.GenericFilterBean

      `addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### ForwardedHeaderFilter

          public ForwardedHeaderFilter()

  - ### Method Detail

    - #### setRemoveOnly

          public void setRemoveOnly(boolean removeOnly)

      Enables mode in which any "Forwarded" or "X-Forwarded-*" headers are removed only and the information in them ignored.
      Parameters:
        `removeOnly` - whether to discard and ignore forwarded headers
      Since:
        4.3.9

    - #### setRelativeRedirects

          public void setRelativeRedirects(boolean relativeRedirects)

      Use this property to enable relative redirects as explained in `RelativeRedirectFilter`, and also using the same response wrapper as that filter does, or if both are configured, only one will wrap.

      By default, if this property is set to false, in which case calls to `HttpServletResponse.sendRedirect(String)` are overridden in order to turn relative into absolute URLs, also taking into account forwarded headers.

      Parameters:
        `relativeRedirects` - whether to use relative redirects
      Since:
        4.3.10

    - #### shouldNotFilter

          protected boolean shouldNotFilter(HttpServletRequest request)

      Description copied from class: `OncePerRequestFilter`
      Can be overridden in subclasses for custom filtering control, returning `true` to avoid filtering of the given request.

      The default implementation always returns `false`.

      Overrides:
        `shouldNotFilter` in class `OncePerRequestFilter`
      Parameters:
        `request` - current HTTP request
      Returns:
        whether the given request should not be filtered

    - #### shouldNotFilterAsyncDispatch

          protected boolean shouldNotFilterAsyncDispatch()

      Description copied from class: `OncePerRequestFilter`
      The dispatcher type `javax.servlet.DispatcherType.ASYNC` introduced in Servlet 3.0 means a filter can be invoked in more than one thread over the course of a single request. Some filters only need to filter the initial thread (e.g. request wrapping) while others may need to be invoked at least once in each additional thread for example for setting up thread locals or to perform final processing at the very end.

      Note that although a filter can be mapped to handle specific dispatcher types via `web.xml` or in Java through the `ServletContext`, servlet containers may enforce different defaults with respect to dispatcher types. This flag enforces the design intent of the filter.

      The default return value is "true", which means the filter will not be invoked during subsequent async dispatches. If "false", the filter will be invoked during async dispatches with the same guarantees of being invoked only once during a request within a single thread.

      Overrides:
        `shouldNotFilterAsyncDispatch` in class `OncePerRequestFilter`

    - #### shouldNotFilterErrorDispatch

          protected boolean shouldNotFilterErrorDispatch()

      Description copied from class: `OncePerRequestFilter`
      Whether to filter error dispatches such as when the servlet container processes and error mapped in `web.xml`. The default return value is "true", which means the filter will not be invoked in case of an error dispatch.
      Overrides:
        `shouldNotFilterErrorDispatch` in class `OncePerRequestFilter`

    - #### doFilterInternal

          protected void doFilterInternal(HttpServletRequest request,
                                          HttpServletResponse response,
                                          FilterChain filterChain)
                                   throws ServletException,
                                          IOException

      Description copied from class: `OncePerRequestFilter`
      Same contract as for `doFilter`, but guaranteed to be just invoked once per request within a single request thread. See `OncePerRequestFilter.shouldNotFilterAsyncDispatch()` for details.

      Provides HttpServletRequest and HttpServletResponse arguments instead of the default ServletRequest and ServletResponse ones.

      Specified by:
        `doFilterInternal` in class `OncePerRequestFilter`
      Throws:
        `ServletException`
        `IOException`

    - #### doFilterNestedErrorDispatch

          protected void doFilterNestedErrorDispatch(HttpServletRequest request,
                                                     HttpServletResponse response,
                                                     FilterChain filterChain)
                                              throws ServletException,
                                                     IOException

      Description copied from class: `OncePerRequestFilter`
      Typically an ERROR dispatch happens after the REQUEST dispatch completes, and the filter chain starts anew. On some servers however the ERROR dispatch may be nested within the REQUEST dispatch, e.g. as a result of calling `sendError` on the response. In that case we are still in the filter chain, on the same thread, but the request and response have been switched to the original, unwrapped ones.

      Sub-classes may use this method to filter such nested ERROR dispatches and re-apply wrapping on the request or response. `ThreadLocal` context, if any, should still be active as we are still nested within the filter chain.

      Overrides:
        `doFilterNestedErrorDispatch` in class `OncePerRequestFilter`
      Throws:
        `ServletException`
        `IOException`