[BUG] ForwardedRemoteAddressResolver ignores single X-Forwarded-For values

[Aias00]

Search before asking

• I had searched in the issues and found no similar issues.

Apache ShenYu Component

shenyu-web

What happened

ForwardedRemoteAddressResolver is the default RemoteAddressResolver bean in the gateway starter:

@Bean
@ConditionalOnMissingBean(RemoteAddressResolver.class)
public RemoteAddressResolver remoteAddressResolver() {
    return new ForwardedRemoteAddressResolver(1);
}

It is used by HostAddressUtils.acquireHost/acquireIp(...), including selector/rule host/ip condition data and logging client IP collection.

However, extractXForwardedValues(...) discards a single non-empty X-Forwarded-For value:

List<String> values = Arrays.asList(xForwardedValues.get(0).split(", "));
if (values.size() == 1 && StringUtils.isNotEmpty(values.get(0))) {
    return Collections.emptyList();
}
return values;

For the common header:

X-Forwarded-For: 203.0.113.10

values.size() is 1 and the value is non-empty, so the resolver returns an empty list and falls back to the TCP remote address instead of using 203.0.113.10.

The parser also splits only on ", ", so a valid comma-separated header without a space, such as 203.0.113.10,198.51.100.1, is treated as one non-empty value and is also ignored.

Expected behavior

A single non-empty X-Forwarded-For value should be accepted. Comma-separated values should be split independent of optional whitespace around the comma, trimmed, and empty values should be ignored.

For example, with the default ForwardedRemoteAddressResolver(1), the resolved address should come from the right trusted index of the X-Forwarded-For chain instead of falling back whenever the header contains only one value.

How to reproduce

1. Start the gateway with the default RemoteAddressResolver bean.
2. Send a request with:

X-Forwarded-For: 203.0.113.10

3. Use a selector/rule condition that depends on client IP, or inspect logging plugin clientIp.
4. The gateway uses exchange.getRequest().getRemoteAddress() instead of 203.0.113.10 because ForwardedRemoteAddressResolver.extractXForwardedValues(...) returns an empty list for the single non-empty header value.

Debug logs

No response

Environment

Current master branch.

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] ForwardedRemoteAddressResolver ignores single X-Forwarded-For values
• Link: [BUG] ForwardedRemoteAddressResolver ignores single X-Forwarded-For values #6503

Please review when you have time. Thank you! 🙏