Allow choice between Forwarded and X-Forwarded headers

This commit introduces a constructor argument to select whether
to use the standard "Forwarded" header or the "X-Forwarded-*"
alternative headers. A separate property to control support for
X-Forwarded-Prefix.

Closes gh-37090

spring-web/src/test/java/org/springframework/web/cors/reactive/CorsUtilsTests.java

@@ -116,7 +116,7 @@ class CorsUtilsTests {
 			builder.header("X-Forwarded-Port", String.valueOf(forwardedPort));
 		}
 
-		ServerHttpRequest request = adaptFromForwardedHeaders(builder);
+		ServerHttpRequest request = adaptFromForwardedHeaders(builder, false);
 		assertThat(CorsUtils.isCorsRequest(request)).isFalse();
 	}
 
@@ -132,14 +132,16 @@ class CorsUtilsTests {
 				.header("Forwarded", forwardedHeader)
 				.header(HttpHeaders.ORIGIN, originHeader);
 
-		ServerHttpRequest request = adaptFromForwardedHeaders(builder);
+		ServerHttpRequest request = adaptFromForwardedHeaders(builder, true);
 		assertThat(CorsUtils.isCorsRequest(request)).isFalse();
 	}
 
 	// SPR-16668
-	private ServerHttpRequest adaptFromForwardedHeaders(MockServerHttpRequest.BaseBuilder<?> builder) {
+	private ServerHttpRequest adaptFromForwardedHeaders(
+			MockServerHttpRequest.BaseBuilder<?> builder, boolean useStandardForwardedHeader) {
+
 		MockServerWebExchange exchange = MockServerWebExchange.from(builder);
-		return new ForwardedHeaderTransformer().apply(exchange.getRequest());
+		return new ForwardedHeaderTransformer(useStandardForwardedHeader).apply(exchange.getRequest());
 	}
 
 }

spring-web/src/test/java/org/springframework/web/filter/ForwardedHeaderFilterTests.java

@@ -68,8 +68,6 @@ class ForwardedHeaderFilterTests {
 	private static final String X_FORWARDED_FOR = "x-forwarded-for";
 
 
-	private final ForwardedHeaderFilter filter = new ForwardedHeaderFilter();
-
 	@SuppressWarnings("serial")
 	private final MockFilterChain filterChain = new MockFilterChain(new HttpServlet() {});
 
@@ -99,12 +97,12 @@ class ForwardedHeaderFilterTests {
 	private void testShouldFilter(String headerName) {
 		MockHttpServletRequest request = new MockHttpServletRequest();
 		request.addHeader(headerName, "1");
-		assertThat(this.filter.shouldNotFilter(request)).isFalse();
+		assertThat(new ForwardedHeaderFilter(false).shouldNotFilter(request)).isFalse();
 	}
 
 	@Test
 	void shouldNotFilter() {
-		assertThat(this.filter.shouldNotFilter(new MockHttpServletRequest())).isTrue();
+		assertThat(new ForwardedHeaderFilter(false).shouldNotFilter(new MockHttpServletRequest())).isTrue();
 	}
 
 	@ParameterizedTest
@@ -117,7 +115,8 @@ class ForwardedHeaderFilterTests {
 		this.request.addHeader("foo", "bar");
 		this.request.addHeader(X_FORWARDED_FOR, "[203.0.113.195]");
 
-		this.filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(false);
+		filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
 		HttpServletRequest actual = (HttpServletRequest) this.filterChain.getRequest();
 
 		assertThat(actual).isNotNull();
@@ -145,8 +144,9 @@ class ForwardedHeaderFilterTests {
 		this.request.addHeader("foo", "bar");
 		this.request.addHeader(X_FORWARDED_FOR, "203.0.113.195");
 
-		this.filter.setRemoveOnly(true);
-		this.filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(false);
+		filter.setRemoveOnly(true);
+		filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
 		HttpServletRequest actual = (HttpServletRequest) this.filterChain.getRequest();
 
 		assertThat(actual).isNotNull();
@@ -175,7 +175,8 @@ class ForwardedHeaderFilterTests {
 		this.request.addHeader(X_FORWARDED_PORT, "443");
 		this.request.addHeader("foo", "bar");
 
-		this.filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(false);
+		filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
 		HttpServletRequest actual = (HttpServletRequest) this.filterChain.getRequest();
 
 		assertThat(actual).isNotNull();
@@ -198,14 +199,15 @@ class ForwardedHeaderFilterTests {
 		this.request.addHeader(X_FORWARDED_HOST, "www.mycompany.example");
 		this.request.addHeader(X_FORWARDED_PORT, "443");
 
-		this.filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(false);
+		filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
 		HttpServletRequest wrappedRequest = (HttpServletRequest) this.filterChain.getRequest();
 
 		this.request.setDispatcherType(DispatcherType.FORWARD);
 		this.request.setRequestURI("/bar");
 		this.filterChain.reset();
 
-		this.filter.doFilter(wrappedRequest, new MockHttpServletResponse(), this.filterChain);
+		filter.doFilter(wrappedRequest, new MockHttpServletResponse(), this.filterChain);
 		HttpServletRequest actual = (HttpServletRequest) this.filterChain.getRequest();
 
 		assertThat(actual).isNotNull();
@@ -223,7 +225,9 @@ class ForwardedHeaderFilterTests {
 		this.request.addHeader(X_FORWARDED_PREFIX, "/app");
 		this.request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/foo");
 
-		this.filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(false);
+		filter.setUseForwardedPrefix(true);
+		filter.doFilter(this.request, new MockHttpServletResponse(), this.filterChain);
 
 		HttpServletRequest wrappedRequest = (HttpServletRequest) this.filterChain.getRequest();
 
@@ -241,7 +245,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(FORWARDED, "for=127.0.0.1:");
 
 			MockHttpServletResponse response = new MockHttpServletResponse();
-			filter.doFilter(request, response, filterChain);
+			new ForwardedHeaderFilter(true).doFilter(request, response, filterChain);
 			assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
 		}
 
@@ -250,7 +254,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(FORWARDED, "for=\"2a02:918:175:ab60:45ee:c12c:dac1:808b\"");
 
 			MockHttpServletResponse response = new MockHttpServletResponse();
-			filter.doFilter(request, response, filterChain);
+			new ForwardedHeaderFilter(true).doFilter(request, response, filterChain);
 			assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
 		}
 
@@ -259,7 +263,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PORT, "invalid");
 
 			MockHttpServletResponse response = new MockHttpServletResponse();
-			filter.doFilter(request, response, filterChain);
+			new ForwardedHeaderFilter(false).doFilter(request, response, filterChain);
 			assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
 		}
 
@@ -305,15 +309,15 @@ class ForwardedHeaderFilterTests {
 			assertThat(actual).isEqualTo("/prefix");
 		}
 
-		private String filterAndGetContextPath() throws ServletException, IOException {
-			return filterAndGetWrappedRequest().getContextPath();
+		private String filterAndGetContextPath() throws Exception {
+			return filterAndGetWrappedRequest(false).getContextPath();
 		}
 
 		@Test
 		void contextPathPreserveEncoding() throws Exception {
 			request.setContextPath("/app%20");
 			request.setRequestURI("/app%20/path/");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getContextPath()).isEqualTo("/app%20");
 			assertThat(actual.getRequestURI()).isEqualTo("/app%20/path/");
@@ -325,7 +329,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/");
 			request.setContextPath("/app");
 			request.setRequestURI("/app/path");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getContextPath()).isEmpty();
 			assertThat(actual.getRequestURI()).isEqualTo("/path");
@@ -336,7 +340,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/");
 			request.setContextPath("/app");
 			request.setRequestURI("/app/path/");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getContextPath()).isEmpty();
 			assertThat(actual.getRequestURI()).isEqualTo("/path/");
@@ -346,7 +350,7 @@ class ForwardedHeaderFilterTests {
 		void requestUriPreserveEncoding() throws Exception {
 			request.setContextPath("/app");
 			request.setRequestURI("/app/path%20with%20spaces/");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getContextPath()).isEqualTo("/app");
 			assertThat(actual.getRequestURI()).isEqualTo("/app/path%20with%20spaces/");
@@ -358,7 +362,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/");
 			request.setContextPath("/app");
 			request.setRequestURI("/app");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getContextPath()).isEmpty();
 			assertThat(actual.getRequestURI()).isEqualTo("/");
@@ -369,7 +373,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/");
 			request.setContextPath("/app");
 			request.setRequestURI("/app/");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getContextPath()).isEmpty();
 			assertThat(actual.getRequestURI()).isEqualTo("/");
@@ -379,7 +383,7 @@ class ForwardedHeaderFilterTests {
 		void requestUriPreserveSemicolonContent() throws Exception {
 			request.setContextPath("");
 			request.setRequestURI("/path;a=b/with/semicolon");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getContextPath()).isEmpty();
 			assertThat(actual.getRequestURI()).isEqualTo("/path;a=b/with/semicolon");
@@ -404,7 +408,7 @@ class ForwardedHeaderFilterTests {
 			};
 			request.addHeader(X_FORWARDED_PREFIX, "/prefix");
 			request.setRequestURI("/path");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getRequestURI()).isEqualTo("/prefix/path");
 		}
@@ -414,7 +418,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/prefix");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/prefix/mvc-showcase");
 		}
 
@@ -423,7 +427,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/prefix/");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/prefix/mvc-showcase");
 		}
 
@@ -432,7 +436,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/first,/second");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/first/second/mvc-showcase");
 		}
 
@@ -441,7 +445,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/first/,/second//");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/first/second/mvc-showcase");
 		}
 
@@ -450,7 +454,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/prefix,/");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/prefix/mvc-showcase");
 		}
 
@@ -459,7 +463,7 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PREFIX, "/prefix/");
 			request.setRequestURI("/mvc-showcase");
 
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 			actual.getRequestURL().append("?key=value");
 			assertThat(actual.getRequestURL().toString()).isEqualTo("http://localhost/prefix/mvc-showcase");
 		}
@@ -471,7 +475,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void xForwardedForEmpty() throws Exception {
 			request.addHeader(X_FORWARDED_FOR, "");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(MockHttpServletRequest.DEFAULT_REMOTE_ADDR);
 			assertThat(actual.getRemoteHost()).isEqualTo(MockHttpServletRequest.DEFAULT_REMOTE_HOST);
@@ -481,7 +485,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void xForwardedForSingleIdentifier() throws Exception {
 			request.addHeader(X_FORWARDED_FOR, "203.0.113.195");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("203.0.113.195");
 			assertThat(actual.getRemotePort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -490,7 +494,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void xForwardedForMultipleIdentifiers() throws Exception {
 			request.addHeader(X_FORWARDED_FOR, "203.0.113.195, 70.41.3.18, 150.172.238.178");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(false);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("203.0.113.195");
 			assertThat(actual.getRemotePort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -499,7 +503,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedForIpV4Identifier() throws Exception {
 			request.addHeader(FORWARDED, "for=203.0.113.195");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("203.0.113.195");
 			assertThat(actual.getRemotePort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -508,7 +512,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedForIpV6Identifier() throws Exception {
 			request.addHeader(FORWARDED, "for=\"[2001:db8:cafe::17]\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("[2001:db8:cafe::17]");
 			assertThat(actual.getRemotePort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -517,7 +521,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedForIpV4IdentifierWithPort() throws Exception {
 			request.addHeader(FORWARDED, "for=\"203.0.113.195:47011\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("203.0.113.195");
 			assertThat(actual.getRemotePort()).isEqualTo(47011);
@@ -526,7 +530,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedForIpV6IdentifierWithPort() throws Exception {
 			request.addHeader(FORWARDED, "For=\"[2001:db8:cafe::17]:47011\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("[2001:db8:cafe::17]");
 			assertThat(actual.getRemotePort()).isEqualTo(47011);
@@ -535,7 +539,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedForMultipleIdentifiers() throws Exception {
 			request.addHeader(FORWARDED, "for=203.0.113.195;proto=http, for=\"[2001:db8:cafe::17]\", for=unknown");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getRemoteAddr()).isEqualTo(actual.getRemoteHost()).isEqualTo("203.0.113.195");
 			assertThat(actual.getRemotePort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -549,7 +553,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedByIpV4Identifier() throws Exception {
 			request.addHeader(FORWARDED, "By=203.0.113.195");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getLocalAddr()).isEqualTo(actual.getLocalAddr()).isEqualTo("203.0.113.195");
 			assertThat(actual.getLocalPort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -558,7 +562,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedByIpV6Identifier() throws Exception {
 			request.addHeader(FORWARDED, "By=\"[2001:db8:cafe::17]\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getLocalAddr()).isEqualTo(actual.getLocalAddr()).isEqualTo("[2001:db8:cafe::17]");
 			assertThat(actual.getLocalPort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -567,7 +571,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedByIpV4IdentifierWithPort() throws Exception {
 			request.addHeader(FORWARDED, "By=\"203.0.113.195:47011\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getLocalAddr()).isEqualTo(actual.getLocalAddr()).isEqualTo("203.0.113.195");
 			assertThat(actual.getLocalPort()).isEqualTo(47011);
@@ -576,7 +580,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedByIpV6IdentifierWithPort() throws Exception {
 			request.addHeader(FORWARDED, "By=\"[2001:db8:cafe::17]:47011\"");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getLocalAddr()).isEqualTo(actual.getLocalAddr()).isEqualTo("[2001:db8:cafe::17]");
 			assertThat(actual.getLocalPort()).isEqualTo(47011);
@@ -585,7 +589,7 @@ class ForwardedHeaderFilterTests {
 		@Test
 		void forwardedByMultipleIdentifiers() throws Exception {
 			request.addHeader(FORWARDED, "by=203.0.113.195;proto=http, by=\"[2001:db8:cafe::17]\", by=unknown");
-			HttpServletRequest actual = filterAndGetWrappedRequest();
+			HttpServletRequest actual = filterAndGetWrappedRequest(true);
 
 			assertThat(actual.getLocalAddr()).isEqualTo(actual.getLocalAddr()).isEqualTo("203.0.113.195");
 			assertThat(actual.getLocalPort()).isEqualTo(MockHttpServletRequest.DEFAULT_SERVER_PORT);
@@ -596,6 +600,8 @@ class ForwardedHeaderFilterTests {
 	@Nested
 	class SendRedirect {
 
+		private ForwardedHeaderFilter filter;
+
 		@Test
 		void sendRedirectWithAbsolutePath() throws Exception {
 			request.addHeader(X_FORWARDED_PROTO, "https");
@@ -721,7 +727,9 @@ class ForwardedHeaderFilterTests {
 			request.addHeader(X_FORWARDED_PROTO, "https");
 			request.addHeader(X_FORWARDED_HOST, "example.com");
 			request.addHeader(X_FORWARDED_PORT, "443");
-			filter.setRelativeRedirects(true);
+
+			this.filter = new ForwardedHeaderFilter(false);
+			this.filter.setRelativeRedirects(true);
 			String location = sendRedirect("/a");
 
 			assertThat(location).isEqualTo("/a");
@@ -729,7 +737,8 @@ class ForwardedHeaderFilterTests {
 
 		@Test
 		void sendRedirectWhenRequestOnlyAndNoXForwardedThenUsesRelativeRedirects() throws Exception {
-			filter.setRelativeRedirects(true);
+			this.filter = new ForwardedHeaderFilter(true);
+			this.filter.setRelativeRedirects(true);
 			String location = sendRedirect("/a");
 
 			assertThat(location).isEqualTo("/a");
@@ -744,16 +753,19 @@ class ForwardedHeaderFilterTests {
 					res.sendRedirect(location);
 				}
 			};
+			this.filter = (this.filter == null ? new ForwardedHeaderFilter(false) : this.filter);
 			MockHttpServletResponse response = new MockHttpServletResponse();
-			FilterChain filterChain = new MockFilterChain(mock(), filter, redirectFilter);
+			FilterChain filterChain = new MockFilterChain(mock(), this.filter, redirectFilter);
 			filterChain.doFilter(request, response);
 			return response.getRedirectedUrl();
 		}
 	}
 
-	private HttpServletRequest filterAndGetWrappedRequest() throws ServletException, IOException {
+	private HttpServletRequest filterAndGetWrappedRequest(boolean useStandardHeader) throws Exception {
 		MockHttpServletResponse response = new MockHttpServletResponse();
-		this.filter.doFilterInternal(this.request, response, this.filterChain);
+		ForwardedHeaderFilter filter = new ForwardedHeaderFilter(useStandardHeader);
+		filter.setUseForwardedPrefix(true);
+		filter.doFilterInternal(this.request, response, this.filterChain);
 		return (HttpServletRequest) this.filterChain.getRequest();
 	}
 

spring-web/src/test/java/org/springframework/web/server/adapter/ForwardedHeaderTransformerTests.java

@@ -39,11 +39,11 @@ class ForwardedHeaderTransformerTests {
 
 	private static final String BASE_URL = "https://example.com/path";
 
-	private final ForwardedHeaderTransformer requestMutator = new ForwardedHeaderTransformer();
 
 	@Test
 	void removeOnly() {
-		this.requestMutator.setRemoveOnly(true);
+		ForwardedHeaderTransformer requestMutator = new ForwardedHeaderTransformer(true);
+		requestMutator.setRemoveOnly(true);
 
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("Forwarded", "for=192.0.2.60;proto=http;by=203.0.113.43");
@@ -53,7 +53,7 @@ class ForwardedHeaderTransformerTests {
 		headers.add("X-Forwarded-Prefix", "prefix");
 		headers.add("X-Forwarded-Ssl", "on");
 		headers.add("X-Forwarded-For", "203.0.113.195");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ServerHttpRequest request = requestMutator.apply(getRequest(headers));
 
 		assertForwardedHeadersRemoved(request);
 	}
@@ -65,7 +65,8 @@ class ForwardedHeaderTransformerTests {
 		headers.add("X-Forwarded-Port", "443");
 		headers.add("X-Forwarded-Proto", "https");
 		headers.add("foo", "bar");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+
+		ServerHttpRequest request = new ForwardedHeaderTransformer(false).apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://84.198.58.199/path"));
 		assertForwardedHeadersRemoved(request);
@@ -75,7 +76,7 @@ class ForwardedHeaderTransformerTests {
 	void forwardedHeader() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("Forwarded", "host=84.198.58.199;proto=https");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ServerHttpRequest request = new ForwardedHeaderTransformer(true).apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://84.198.58.199/path"));
 		assertForwardedHeadersRemoved(request);
@@ -85,7 +86,9 @@ class ForwardedHeaderTransformerTests {
 	void xForwardedPrefix() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-Prefix", "/prefix");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		ServerHttpRequest request = transformer.apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/prefix/path"));
 		assertThat(request.getPath().value()).isEqualTo("/prefix/path");
@@ -101,7 +104,9 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		request = transformer.apply(request);
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/prefix/a%20b?q=a%2Bb"));
 		assertThat(request.getPath().value()).isEqualTo("/prefix/a%20b");
@@ -112,7 +117,9 @@ class ForwardedHeaderTransformerTests {
 	void xForwardedPrefixTrailingSlash() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-Prefix", "/prefix////");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		ServerHttpRequest request = transformer.apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/prefix/path"));
 		assertThat(request.getPath().value()).isEqualTo("/prefix/path");
@@ -129,7 +136,7 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(true).apply(request);
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://84.198.58.199/a%20b?q=a%2Bb"));
 		assertForwardedHeadersRemoved(request);
@@ -144,7 +151,7 @@ class ForwardedHeaderTransformerTests {
 							.headers(headers)
 							.build();
 
-			request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(true).apply(request);
 
 			assertThat(request.getURI()).isEqualTo(URI.create("https://84.198.58.199/a?q=1+1=2"));
 			assertForwardedHeadersRemoved(request);
@@ -154,7 +161,9 @@ class ForwardedHeaderTransformerTests {
 	void shouldConcatenatePrefixes() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-Prefix", "/first,/second");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		ServerHttpRequest request = transformer.apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/first/second/path"));
 		assertThat(request.getPath().value()).isEqualTo("/first/second/path");
@@ -165,7 +174,9 @@ class ForwardedHeaderTransformerTests {
 	void shouldConcatenatePrefixesWithTrailingSlashes() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-Prefix", "/first/,/second//");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		ServerHttpRequest request = transformer.apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/first/second/path"));
 		assertThat(request.getPath().value()).isEqualTo("/first/second/path");
@@ -176,7 +187,9 @@ class ForwardedHeaderTransformerTests {
 	void shouldRemoveSingleTrailingSlash() {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-Prefix", "/prefix,/");
-		ServerHttpRequest request = this.requestMutator.apply(getRequest(headers));
+		ForwardedHeaderTransformer transformer = new ForwardedHeaderTransformer(false);
+		transformer.setUseForwardedPrefix(true);
+		ServerHttpRequest request = transformer.apply(getRequest(headers));
 
 		assertThat(request.getURI()).isEqualTo(URI.create("https://example.com/prefix/path"));
 		assertThat(request.getPath().value()).isEqualTo("/prefix/path");
@@ -196,7 +209,7 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(true).apply(request);
 		assertThat(request.getRemoteAddress()).isEqualTo(remoteAddress);
 	}
 
@@ -213,7 +226,7 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(true).apply(request);
 		assertThat(request.getRemoteAddress()).isNotNull();
 		assertThat(request.getRemoteAddress().getHostName()).isEqualTo("203.0.113.195");
 		assertThat(request.getRemoteAddress().getPort()).isEqualTo(4711);
@@ -229,7 +242,7 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(false).apply(request);
 		assertThat(request.getRemoteAddress()).isNotNull();
 		assertThat(request.getRemoteAddress().getHostName()).isEqualTo("203.0.113.195");
 	}
@@ -247,7 +260,7 @@ class ForwardedHeaderTransformerTests {
 				.headers(headers)
 				.build();
 
-		request = this.requestMutator.apply(request);
+		request = new ForwardedHeaderTransformer(true).apply(request);
 		assertThat(request.getLocalAddress()).isNotNull();
 		assertThat(request.getLocalAddress().getHostName()).isEqualTo("203.0.113.195");
 		assertThat(request.getLocalAddress().getPort()).isEqualTo(4711);

spring-web/src/test/java/org/springframework/web/server/adapter/WebHttpHandlerBuilderTests.java

@@ -316,7 +316,7 @@ class WebHttpHandlerBuilderTests {
 
 		@Bean
 		public ForwardedHeaderTransformer forwardedHeaderTransformer() {
-			return new ForwardedHeaderTransformer();
+			return new ForwardedHeaderTransformer(true);
 		}
 
 		@Bean

spring-web/src/test/java/org/springframework/web/util/ForwardedHeaderUtilsTests.java

@@ -51,7 +51,7 @@ class ForwardedHeaderUtilsTests {
 		request.setQueryString("a=1");
 
 		ServletServerHttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 		assertThat(result.getScheme()).isEqualTo("http");
 		assertThat(result.getHost()).isEqualTo("localhost");
 		assertThat(result.getPort()).isEqualTo(-1);
@@ -72,7 +72,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo(protocol);
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -93,7 +93,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/path");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo(protocol);
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -111,7 +111,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("Forwarded", "host=192.168.0.1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("https://192.168.0.1/mvc-showcase");
 	}
@@ -126,7 +126,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("Forwarded", "host=[1abc:2abc:3abc::5ABC:6abc]");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("http://[1abc:2abc:3abc::5ABC:6abc]/mvc-showcase");
 	}
@@ -141,7 +141,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "[1abc:2abc:3abc::5ABC:6abc]");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("http://[1abc:2abc:3abc::5ABC:6abc]/mvc-showcase");
 	}
@@ -156,7 +156,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "[1abc:2abc:3abc::5ABC:6abc]:8080");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("http://[1abc:2abc:3abc::5ABC:6abc]:8080/mvc-showcase");
 	}
@@ -172,8 +172,7 @@ class ForwardedHeaderUtilsTests {
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
 
-		assertThatThrownBy(() ->
-				ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build())
+		assertThatThrownBy(() -> adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()))
 				.isInstanceOf(IllegalArgumentException.class);
 	}
 
@@ -187,7 +186,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "anotherHost");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("https://anotherHost/mvc-showcase");
 	}
@@ -202,7 +201,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "webtest.foo.bar.com:443");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getHost()).isEqualTo("webtest.foo.bar.com");
 		assertThat(result.getPort()).isEqualTo(443);
@@ -217,7 +216,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "a.example.org, b.example.org, c.example.org");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getHost()).isEqualTo("a.example.org");
 		assertThat(result.getPort()).isEqualTo(-1);
@@ -233,7 +232,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Port", "9090");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getHost()).isEqualTo("foobarhost");
 		assertThat(result.getPort()).isEqualTo(9090);
@@ -248,7 +247,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Host", "example.org");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getHost()).isEqualTo("example.org");
 		assertThat(result.getPort()).isEqualTo(-1);
@@ -263,7 +262,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Proto", "https");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("example.org");
@@ -279,7 +278,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Ssl", "on");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("example.org");
@@ -296,7 +295,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Proto", "https");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getHost()).isEqualTo("example.org");
 		assertThat(result.getScheme()).isEqualTo("https");
@@ -315,7 +314,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Port", "443");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("https://84.198.58.199/mvc-showcase");
 	}
@@ -331,7 +330,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Port", "80,52022");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("http://a.example.org/mvc-showcase");
 	}
@@ -348,7 +347,7 @@ class ForwardedHeaderUtilsTests {
 		request.addHeader("X-Forwarded-Proto", "https,https");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("https://a.example.org/mvc-showcase");
 	}
@@ -376,7 +375,7 @@ class ForwardedHeaderUtilsTests {
 				return new HttpHeaders();
 			}
 		};
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(request.getURI(), request.getHeaders()).build();
+		UriComponents result = adaptFromXForwardedHeaders(request.getURI(), request.getHeaders());
 
 		assertThat(result.toString()).isEqualTo("/");
 	}
@@ -390,7 +389,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -406,7 +405,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -423,7 +422,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -439,7 +438,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -455,7 +454,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -474,7 +473,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -493,7 +492,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("84.198.58.199");
@@ -512,7 +511,7 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		UriComponents result = adaptFromForwardedHeader(httpRequest.getURI(), httpRequest.getHeaders());
 
 		assertThat(result.getScheme()).isEqualTo("https");
 		assertThat(result.getHost()).isEqualTo("example.com");
@@ -531,13 +530,17 @@ class ForwardedHeaderUtilsTests {
 		request.setRequestURI("/rest/mobile/users/1");
 
 		HttpRequest httpRequest = new ServletServerHttpRequest(request);
-		UriComponents result = ForwardedHeaderUtils.adaptFromForwardedHeaders(httpRequest.getURI(), httpRequest.getHeaders()).build();
+		ForwardedHeaderUtils.ForwardedInfo info =
+				ForwardedHeaderUtils.parseStandardHeader(httpRequest.getURI(), httpRequest.getHeaders(), null, null);
 
-		assertThat(result.getScheme()).isEqualTo("https");
-		assertThat(result.getHost()).isEqualTo("192.0.2.3");
+		assertThat(info.forAddress()).isNotNull();
+		assertThat(info.forAddress().getHostString()).isEqualTo("192.0.2.0");
+
+		UriComponents result = info.uriComponentsBuilder().build();
+		assertThat(result.getScheme()).isEqualTo("http");
+		assertThat(result.getHost()).isEqualTo("example.com");
 		assertThat(result.getPath()).isEqualTo("/rest/mobile/users/1");
-		assertThat(result.getPort()).isEqualTo(9090);
-		assertThat(result.toUriString()).isEqualTo("https://192.0.2.3:9090/rest/mobile/users/1");
+		assertThat(result.getPort()).isEqualTo(8080);
 	}
 
 	@Test  // gh-34253
@@ -545,8 +548,8 @@ class ForwardedHeaderUtilsTests {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("X-Forwarded-For", "fd00:fefe:1::4, 192.168.0.1");
 
-		InetSocketAddress address =
-				ForwardedHeaderUtils.parseForwardedFor(URI.create("https://example.com"), headers, null);
+		InetSocketAddress address = ForwardedHeaderUtils.parseXForwardedHeaders(
+				URI.create("https://example.com"), headers, null, null).forAddress();
 
 		assertThat(address.getHostName()).isEqualTo("[fd00:fefe:1::4]");
 	}
@@ -556,10 +559,21 @@ class ForwardedHeaderUtilsTests {
 		HttpHeaders headers = new HttpHeaders();
 		headers.add("Forwarded", "by=[fd00:fefe:1::4], 192.168.0.1");
 
-		InetSocketAddress address =
-				ForwardedHeaderUtils.parseForwardedBy(URI.create("https://example.com"), headers, null);
+		InetSocketAddress address = ForwardedHeaderUtils.parseStandardHeader(
+				URI.create("https://example.com"), headers, null, null).byAddress();
 
 		assertThat(address.getHostName()).isEqualTo("[fd00:fefe:1::4]");
 	}
 
+
+	private static UriComponents adaptFromForwardedHeader(URI uri, HttpHeaders headers) {
+		return ForwardedHeaderUtils.parseStandardHeader(uri, headers, null, null)
+				.uriComponentsBuilder().build();
+	}
+
+	private static UriComponents adaptFromXForwardedHeaders(URI uri, HttpHeaders headers) {
+		return ForwardedHeaderUtils.parseXForwardedHeaders(uri, headers, null, null)
+				.uriComponentsBuilder().build();
+	}
+
 }

spring-web/src/test/java/org/springframework/web/util/WebUtilsTests.java

@@ -219,7 +219,7 @@ class WebUtilsTests {
 		}
 		request.addHeader(HttpHeaders.ORIGIN, originHeader);
 
-		HttpServletRequest requestToUse = adaptFromForwardedHeaders(request);
+		HttpServletRequest requestToUse = adaptFromForwardedHeaders(request, false);
 		ServerHttpRequest httpRequest = new ServletServerHttpRequest(requestToUse);
 
 		assertThat(WebUtils.isSameOrigin(httpRequest)).isTrue();
@@ -236,16 +236,18 @@ class WebUtilsTests {
 		request.addHeader("Forwarded", forwardedHeader);
 		request.addHeader(HttpHeaders.ORIGIN, originHeader);
 
-		HttpServletRequest requestToUse = adaptFromForwardedHeaders(request);
+		HttpServletRequest requestToUse = adaptFromForwardedHeaders(request, true);
 		ServerHttpRequest httpRequest = new ServletServerHttpRequest(requestToUse);
 
 		assertThat(WebUtils.isSameOrigin(httpRequest)).isTrue();
 	}
 
 	// SPR-16668
-	private HttpServletRequest adaptFromForwardedHeaders(HttpServletRequest request) throws Exception {
+	private HttpServletRequest adaptFromForwardedHeaders(
+			HttpServletRequest request, boolean useStandardForwardedHeader) throws Exception {
+
 		MockFilterChain chain = new MockFilterChain();
-		new ForwardedHeaderFilter().doFilter(request, new MockHttpServletResponse(), chain);
+		new ForwardedHeaderFilter(useStandardForwardedHeader).doFilter(request, new MockHttpServletResponse(), chain);
 		return (HttpServletRequest) chain.getRequest();
 	}