Closed
Description
In version 5.1.x, the ServletUriComponentsBuilder
methods changed to remove the usage of forwarded headers:
- code change:
4da43de
; Centralize handling of "Forwarded" headers to ForwardedHeaderFilter [SPR-16668] #21209 - docs clarifications:
bb5c8ed
); Misleading JavaDoc in ServletUriComponentsBuilder [SPR-17317] #21850
However, the method and class documentation in MvcUriComponentsBuilder
was not updated and still indicates the forwarded headers are used. (see instances of Note:
in the javadocs) Yet MvcUriComponentsBuilder
internally uses ServletUriComponentsBuilder
for URI components resolution:
This affects 5.1.x -> 7.0.x.
Simple test:
@Test
void testMvcUriComponentsBuilder() {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServerName("localhost");
request.setServerPort(8080);
request.setScheme("http");
request.addHeader("X-Forwarded-Proto", "https");
request.addHeader("X-Forwarded-Host", "test.example.com");
request.addHeader("X-Forwarded-Port", "443");
RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(request, new MockHttpServletResponse()));
@Controller
@RequestMapping("/test")
class InnerController {}
String expected = MvcUriComponentsBuilder.fromController(InnerController.class).toUriString();
assertEquals(expected, "https://test.example.com");
}
Error:
expected: <http://localhost:8080/test> but was: <https://test.example.com>