added trustForwardHeaders method to decide if to trust HTTP forward headers

perwendel / spark

A simple expressive web framework for java. Spark has a kotlin DSL https://github.com/perwendel/spark-kotlin

Apache License 2.0

9.63k stars 1.56k forks source link

Closed Arisstath closed 3 years ago

Arisstath commented 3 years ago

It seems that from https://github.com/perwendel/spark/issues/320 Spark blindly trusts HTTP headers that can be spoofed, with no way to disable this behavior.

The newly introduced method Spark.trustForwardHeaders allows you to specify if you want to use jetty's ForwardedRequestCustomizer (https://www.eclipse.org/jetty/javadoc/current/org/eclipse/jetty/server/ForwardedRequestCustomizer.html)

perwendel commented 3 years ago

I made some modifications to maintain backwards compatibility and renamed some methods. Thanks for contributing.