Skip to content

Add support for X-Forwarded-Host using Tomcat's new RemoteIpValve hostHeader attribute #18233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
NFarrington opened this issue Sep 15, 2019 · 1 comment
Assignees
Labels
type: enhancement A general enhancement
Milestone

Comments

@NFarrington
Copy link

Tomcat now supports the X-Forwarded-Host header, per https://bz.apache.org/bugzilla/show_bug.cgi?id=57665 (as referenced in #5677).

It would be great to add support for this in order to enable a more complete support for X-Forwarded-* headers without needing to use the ForwardedHeaderFilter, and to provide closer feature parity with what's available in RemoteIpValve.

The current (Spring Boot 2.1.8.RELEASE) RemoteIpValve configuration can be found here:

private void customizeRemoteIpValve(ConfigurableTomcatWebServerFactory factory) {
Tomcat tomcatProperties = this.serverProperties.getTomcat();
String protocolHeader = tomcatProperties.getProtocolHeader();
String remoteIpHeader = tomcatProperties.getRemoteIpHeader();
// For back compatibility the valve is also enabled if protocol-header is set
if (StringUtils.hasText(protocolHeader) || StringUtils.hasText(remoteIpHeader)
|| getOrDeduceUseForwardHeaders()) {
RemoteIpValve valve = new RemoteIpValve();
valve.setProtocolHeader(StringUtils.hasLength(protocolHeader) ? protocolHeader : "X-Forwarded-Proto");
if (StringUtils.hasLength(remoteIpHeader)) {
valve.setRemoteIpHeader(remoteIpHeader);
}
// The internal proxies default to a white list of "safe" internal IP
// addresses
valve.setInternalProxies(tomcatProperties.getInternalProxies());
valve.setPortHeader(tomcatProperties.getPortHeader());
valve.setProtocolHeaderHttpsValue(tomcatProperties.getProtocolHeaderHttpsValue());
// ... so it's safe to add this valve by default.
factory.addEngineValves(valve);
}
}

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Sep 15, 2019
@philwebb
Copy link
Member

This is the relevant Tomcat commit: apache/tomcat@67c3af9

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

5 participants