Documentation for ForwardedHeaderFilter does not mention important filter order

[ctytgat]

Affects: 5.1.10

It took me half a day to figure out why my spring hateoas / ForwardedHeaderFilter setup did not work as intended.

It appeared that the HttpServletRequest used by ServletUriComponentsBuilder wasn't the wrapped one, which is caused by the fact that ForwardedHeaderFilter was executed AFTER RequestContextFilter.

You basically need to do this:

    @Bean
    public FilterRegistrationBean forwardedHeaderFilterRegistrationBean() {

        FilterRegistrationBean<ForwardedHeaderFilter> registrationBean = new FilterRegistrationBean<>();

        registrationBean.setFilter(new ForwardedHeaderFilter());
        registrationBean.addUrlPatterns("*");
        registrationBean.setOrder(org.springframework.boot.web.servlet.filter.OrderedFilter.REQUEST_WRAPPER_FILTER_MAX_ORDER - 1);

        return registrationBean;
    }

I didn't find any mention of this in the docs...

[sbrannen]

@ctytgat, are you suggesting that this be documented in the Spring Boot reference manual?

[ctytgat]

Hi, yes that would certainly be useful.
https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#filters-forwarded-headers
A mention in the spring-hateoas docs might be a good idea as well.