diff --git a/spring-web/src/main/java/org/springframework/web/bind/annotation/CrossOrigin.java b/spring-web/src/main/java/org/springframework/web/bind/annotation/CrossOrigin.java index d39ff580793..7185ae1d0f7 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/annotation/CrossOrigin.java +++ b/spring-web/src/main/java/org/springframework/web/bind/annotation/CrossOrigin.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2016 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -88,6 +88,13 @@ public @interface CrossOrigin { * header of both the pre-flight response and the actual response. * {@code "*"} means that all origins are allowed. *

If undefined, all origins are allowed. + *

Note: CORS checks use values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * @see #value */ @AliasFor("value") diff --git a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java index 664401853cb..8304b212fbc 100644 --- a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java +++ b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -106,6 +106,13 @@ public class CorsConfiguration { * Set the origins to allow, e.g. {@code "http://domain1.com"}. *

The special value {@code "*"} allows all domains. *

By default this is not set. + *

Note: CORS checks use values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. */ public void setAllowedOrigins(List allowedOrigins) { this.allowedOrigins = (allowedOrigins != null ? new ArrayList(allowedOrigins) : null); diff --git a/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java b/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java index 3fc4271386a..2d0b8175918 100644 --- a/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java +++ b/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java @@ -278,6 +278,11 @@ public class UriComponentsBuilder implements Cloneable { * "Forwarded" (RFC 7239), * or "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" if * "Forwarded" is not found. + *

Note: this method uses values from forwarded headers, + * if present, in order to reflect the client-originated protocol and address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * @param request the source request * @return the URI components of the URI * @since 4.1.5 diff --git a/spring-web/src/main/java/org/springframework/web/util/WebUtils.java b/spring-web/src/main/java/org/springframework/web/util/WebUtils.java index 1bf09c6a524..4483f95703e 100644 --- a/spring-web/src/main/java/org/springframework/web/util/WebUtils.java +++ b/spring-web/src/main/java/org/springframework/web/util/WebUtils.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -790,6 +790,13 @@ public abstract class WebUtils { * Check the given request origin against a list of allowed origins. * A list containing "*" means that all origins are allowed. * An empty list means only same origin is allowed. + *

Note: this method may use values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * @return {@code true} if the request origin is valid, {@code false} otherwise * @since 4.1.5 * @see RFC 6454: The Web Origin Concept @@ -814,6 +821,13 @@ public abstract class WebUtils { * Check if the request is a same-origin one, based on {@code Origin}, {@code Host}, * {@code Forwarded}, {@code X-Forwarded-Proto}, {@code X-Forwarded-Host} and * @code X-Forwarded-Port} headers. + *

Note: this method uses values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * @return {@code true} if the request is a same-origin one, {@code false} in case * of cross-origin request * @since 4.2 diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java index 748735b8c21..425ed54c4bd 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/CorsRegistration.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2016 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,7 +16,6 @@ package org.springframework.web.servlet.config.annotation; -import java.util.ArrayList; import java.util.Arrays; import org.springframework.web.cors.CorsConfiguration; @@ -60,6 +59,13 @@ public class CorsRegistration { * Set the origins to allow, e.g. {@code "http://domain1.com"}. *

The special value {@code "*"} allows all domains. *

By default, all origins are allowed. + *

Note: CORS checks use values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. */ public CorsRegistration allowedOrigins(String... origins) { this.config.setAllowedOrigins(Arrays.asList(origins)); diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/MvcUriComponentsBuilder.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/MvcUriComponentsBuilder.java index 3e2435380ec..dcdf713ecf7 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/MvcUriComponentsBuilder.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/MvcUriComponentsBuilder.java @@ -82,14 +82,13 @@ import org.springframework.web.util.UriComponentsBuilder; * {@link #relativeTo(org.springframework.web.util.UriComponentsBuilder)}. * * - *

Note: This class extracts and uses values from the headers - * "Forwarded" (RFC 7239), - * or "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" if - * "Forwarded" is not found, in order to reflect the client-originated protocol - * and address. As an alternative consider using the - * {@link org.springframework.web.filter.ForwardedHeaderFilter} to have such - * headers extracted once and removed, or removed only (without being used). - * See the reference for further information including security considerations. + *

Note: This class uses values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated protocol and address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * * @author Oliver Gierke * @author Rossen Stoyanchev diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java index 0c75ad178bf..8ea7004d7ce 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java @@ -35,14 +35,13 @@ import org.springframework.web.util.UrlPathHelper; * UriComponentsBuilder with additional static factory methods to create links * based on the current HttpServletRequest. * - *

Note: This class extracts and uses values from the headers - * "Forwarded" (RFC 7239), - * or "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" if - * "Forwarded" is not found, in order to reflect the client-originated protocol - * and address. As an alternative consider using the - * {@link org.springframework.web.filter.ForwardedHeaderFilter} to have such - * headers extracted once and removed, or removed only (without being used). - * See the reference for further information including security considerations. + *

Note: This class uses values from "Forwarded" + * (RFC 7239), + * "X-Forwarded-Host", "X-Forwarded-Port", and "X-Forwarded-Proto" headers, + * if present, in order to reflect the client-originated protocol and address. + * Consider using the {@code ForwardedHeaderFilter} in order to choose from a + * central place whether to extract and use, or to discard such headers. + * See the Spring Framework reference for more on this filter. * * @author Rossen Stoyanchev * @since 3.1 diff --git a/spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc-4.3.xsd b/spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc-4.3.xsd index 1e8ecb1e0f9..68b2a5687a1 100644 --- a/spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc-4.3.xsd +++ b/spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc-4.3.xsd @@ -1323,6 +1323,12 @@