Join GitHub today
X-Forwarded-Proto with comma separated list causes incorrect scheme [SPR-12816] #17413
This issue is very similar to #17410. In the UriComponentsBuilder, the scheme is set using the following X-Forwarded-Proto which can be a comma separated list as well. For example, I am seeing "http,http" as the value of my X-Forwarded-Proto header.
String protocolHeader = request.getHeaders().getFirst("X-Forwarded-Proto");
This causes issues later on when the URIs are built due to the invalid characters within the scheme.