Add 'server.remove-forward-headers' options

[bclozel]

Enabling that option should create a ForwardedHeaderFilter option and remove Forwarded headers.

This is especially useful if your application is looking at Forwarded headers even though it's not protected by a proxy (adding/removing those headers already).

See Rossen's comment in #10900 (comment) for more background about this.

[rstoyanchev]

An additional question is whether this property should be set by default. Doing so would cause applications that actually need to use forwarded headers to fail but the failure cause should be fairly obvious. The benefit is that it leads down a safer path of explicitly opting into the use of forwarded headers. Note also that setting the flag by default has the potential and likely will cause regression in applications that currently rely on forwarded headers implicitly, i.e. by virtue of using MvcUriComponentsBuilder or ServletUriComponentsBuilder to create links.

[bclozel]

One thing bothers me, though. If that's really insecure and not obvious, why is that the default in Spring Framework? Shouldn't ServletUriComponentsBuilder and MvcUriComponentsBuilder be safe by default?

[rstoyanchev]

That's just it though, there is no way to toggle this on and off in the Spring Framework. The only option would be to stop consuming those headers.

[rstoyanchev]

The only option would be to stop consuming those headers.

And that's what we intend to do in 5.1 https://jira.spring.io/browse/SPR-16668.

[sangeetha5491]

Is this still an active issue that needs to be worked on?

[wilkinsona]

@sangeetha5491 Yes, although I don't think we know exactly what form that work should take just yet.