Most proxies support the alternative X-Forwarded headers only. We support both the standard RFC 7239 Forwarded header, and the alternative X-Forwarded headers.
To make the behavior more deterministic, when forwarded headers are enabled, we should require a boolean choice of whether the application expects "Forwarded" or "X-Forwarded-*" headers for -proto, -host, -port, and -for, and check only the ones that are expected.
Separate properties should enable support for the less common "X-Forwarded-Ssl" and "X-Forwarded-Prefix" if those are expected and needed.
We should update the documentation with more guidance on the choice of forwarded headers, and the need for proxies to handle both at the edge.
There is a related forwarded header parsing improvement #36964 that this change technically depends on given the layout of internal APIs for forwarded headers.
Most proxies support the alternative X-Forwarded headers only. We support both the standard RFC 7239 Forwarded header, and the alternative X-Forwarded headers.
To make the behavior more deterministic, when forwarded headers are enabled, we should require a boolean choice of whether the application expects
"Forwarded"or"X-Forwarded-*"headers for-proto,-host,-port, and-for, and check only the ones that are expected.Separate properties should enable support for the less common
"X-Forwarded-Ssl"and"X-Forwarded-Prefix"if those are expected and needed.We should update the documentation with more guidance on the choice of forwarded headers, and the need for proxies to handle both at the edge.
There is a related forwarded header parsing improvement #36964 that this change technically depends on given the layout of internal APIs for forwarded headers.