Skip to content

Control fallback port when omitted in "Forwarded:for=xxx" - #37116

Open
jespersm wants to merge 1 commit into
spring-projects:mainfrom
jespersm:gh-37114
Open

Control fallback port when omitted in "Forwarded:for=xxx"#37116
jespersm wants to merge 1 commit into
spring-projects:mainfrom
jespersm:gh-37114

Conversation

@jespersm

@jespersm jespersm commented Aug 5, 2026

Copy link
Copy Markdown

Default to reserved client port '0' (instead of server port number)

  • Parsers in ForwardedHeaderUtils now return 0 as the unknown client port when it was not supplied by the proxy and no remoteAddress was supplied.
  • Applies to both deprecated and new parsers for standardized "Forwarded" and "X-Forwarded-For"

Closes gh-37114

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Aug 5, 2026
…rded:for=xxx"

 - Parsers in `ForwardedHeaderUtils` now return `0` as the unknown client port when it was not supplied by the proxy and no `remoteAddress` was supplied.

Signed-off-by: Jesper Steen Møller <jesper@selskabet.org>
@sbrannen sbrannen added the in: web Issues in web modules (web, webmvc, webflux, websocket) label Aug 6, 2026
@sbrannen sbrannen changed the title GH-37114: Control fallback port when omitted in "Forwarded:for=xxx" Control fallback port when omitted in "Forwarded:for=xxx" Aug 6, 2026
@yashsiwacha

Copy link
Copy Markdown

Excellent fix. Restricting the fallback port to 0 instead of the request URI's port when remoteAddress is null aligns ForwardedHeaderUtils with RFC 7239.

A few details I noted:

  • Differentiating between the client for address (which should fallback to 0/unknown) and the proxy by address (which naturally falls back to the URI scheme port because the proxy spoke to the server) is architecturally correct.
  • Retaining uri in the deprecated parseForwardedFor signature preserves backward binary compatibility for existing integrations.
  • The new tests cover both default (port 0) and explicit port configurations.

Looks good to merge!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: web Issues in web modules (web, webmvc, webflux, websocket) status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Misleading port number defaults when parsing 'Forwarded' header

4 participants