Repository navigation
Improve reference documentation on Forwarded vs X-Forwarded headers #19461
Description
Most proxies currently support the alternative "X-Forwarded-*" headers rather than the standard "Forwarded" header from RFC 7239 while the Spring Framework and servers like Reactor Netty and Jetty support both. That means a proxy at the edge needs to be configured correctly to drop untrusted values.
The current coverage of forwarded headers in the reference docs conflates RFC 7239 and X-Forwarded headers a bit, but should instead guide towards differentiating between both types of headers, and ensuring that proxies are configured correctly to with awareness of both types of forwarded headers.
Activity
jzheaux commentedon Aug 3, 2026
Thanks for flagging this, @rstoyanchev — #19477 fixes it. Setting the milestone there.
Differentiate Forwarded and X-Forwarded headers in proxy docs
Differentiate Forwarded and X-Forwarded headers in proxy docs
Differentiate Forwarded and X-Forwarded headers in proxy docs