Support multiple comma-separated values in X-Forwarded-Host header [SPR-11140]

[spring-projects-issues]

Chris Pimlott opened SPR-11140 and commented

The support for the X-Forwarded-Host header added in #14743 does not account for having multiple comma-separated hosts in the header, e.g.:

X-Forwarded-Host: foo.com, bar.com, baz.com

Test case:

  @Test
  public void testMultiValuedXForwardedHostHeader() {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("X-Forwarded-Host", "a.example.org, b.example.org, c.example.org");

    assertEquals("a.example.org", ServletUriComponentsBuilder.fromRequest(request).build().getHost());
  }

---

Affects: 3.2.5

[spring-projects-issues]

Chris Pimlott commented

This issue on another project has an example Apache configuration that generates a multi-valued X-Forwarded-Host header:

xp-framework/xp-framework#162

[spring-projects-issues]

Rossen Stoyanchev commented

This was already working as of 4.0 RC1 as part of changes introducing MvcUriComponentsBuilder. It is now fixed in 3.2.x as well.