The proxy server section pointed at RFC 7239 and then told the reader to
configure the application server for the X-Forwarded headers, conflating
the standard Forwarded header with the non-standard X-Forwarded-* set.
Describe the two kinds of headers separately, note that most proxies send
X-Forwarded-* while Spring Framework and servers such as Reactor Netty and
Jetty understand both, and state that the edge proxy has to drop or
overwrite untrusted values for both kinds rather than only one.
Closes gh-19461
Signed-off-by: Sumit Kumar Das <skdas5405@gmail.com>
This commit removes unnecessary main-branch merges starting from
8750608b5b and adds the following
needed commit(s) that were made afterward:
- 5dce82c48b
This updates references to the deprecated server.use-forward-headers property to the recommended server.forward-headers-strategy property. This also mentions the Reactive ForwardedHeaderTransformer alongside the ForwardedHeaderFilter and updates their links to point to the respective reference docs.
Josh Cummings