arturobernalg opened a new pull request, #1168: URL: https://github.com/apache/tomcat/pull/1168
https://bz.apache.org/bugzilla/show_bug.cgi?id=63080 Adds support for the RFC 7239 `Forwarded` header to `RemoteIpValve` and `RemoteIpFilter`, following the approach suggested in the issue: a new `forwardedStrategy` attribute (an init-param in the filter) with the values `legacy`, `rfc7239` and `both`. `legacy` is the default and does not change the current behaviour. With `both`, `Forwarded` is used if the request has it and the `X-Forwarded-*` headers are used otherwise. The two are never merged. The header is parsed by a new class, `Forwarded`, which follows the grammar of the RFC (quoted strings, IPv6 nodes, obfuscated identifiers, `unknown` and several header fields). As with the existing headers, nothing is processed unless the connection comes from an internal or trusted proxy, and the elements are processed from right to left. `for` is used to find the client. `unknown`, obfuscated identifiers and host names are never used as the remote address and are never resolved. `proto` and `host` are taken from the elements written by trusted proxies and `by` is ignored. The elements that were not processed are left in the `Forwarded` header. A `Forwarded` field value that is not syntactically valid is answered with 400. An unterminated quoted string could otherwise hide the element added by a trusted proxy. There are tests for the parser, the valve and the filter. Happy to change the names of the attribute or of its values. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
