Spring Security StrictHttpFirewall未校验请求头问题求助

我尝试通过自定义StrictHttpFirewall来拒绝请求头不符合指定正则规则的请求，但配置后并未生效——即使传入不符合规则的请求头，请求依然能正常通过。调试发现，请求确实携带了违规请求头，但Spring Security没有执行校验；只有当控制器方法参数用@RequestHeader(value = "my-header", required = true)标记必填请求头时，才会触发校验。

我的Spring Security配置代码如下：

@Configuration
@EnableWebSecurity
class SecurityConfig {

    companion object {
        private val HEADER_NAME_PATTERN = "^[a-z1-9_-]{1,512}$".toRegex(RegexOption.IGNORE_CASE)
        private val HEADER_VALUE_BASE_PATTERN = "[\\p{IsAssigned}&&[^\\p{IsControl}]]*".toRegex()
        private val HEADER_VALUE_ERROR_PATTERN = "[<>]".toRegex()
    }

    @Bean
    fun requestRejectedHandler(): RequestRejectedHandler = ErrorResponseRequestRejectedHandler()

    @Bean
    fun httpFirewall(): HttpFirewall {
        val firewall = StrictHttpFirewall()
        val headerNames = { header: String -> HEADER_NAME_PATTERN.matches(header) }
        val headerValues = { value: String ->
            HEADER_VALUE_BASE_PATTERN.containsMatchIn(value).and(
                !HEADER_VALUE_ERROR_PATTERN.containsMatchIn(value)
            )
        }
        firewall.setAllowedHeaderNames(headerNames)
        firewall.setAllowedHeaderValues(headerValues)
        firewall.setAllowedHttpMethods(
            listOf(GET.name(), POST.name(), PUT.name(), PATCH.name(), DELETE.name())
        )
        return firewall
    }

    @Bean
    @Throws(Exception::class)
    fun filterChain(http: HttpSecurity): SecurityFilterChain =
        http
            .authorizeHttpRequests { it.anyRequest().permitAll() }
            .sessionManagement {
                it
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .disable()
            }
            .headers {
                it
                    .frameOptions { option -> option.sameOrigin() }
                    .xssProtection(Customizer.withDefaults())
                    .cacheControl { cache -> cache.disable() }
                    .contentSecurityPolicy(Customizer.withDefaults())
            }
            .cors { it.disable() }
            .csrf { it.disable() }
            .requestCache { it.disable() }
            .build()
}

已尝试的解决方法（均无效） #

• 显式将自定义httpFirewall配置到WebSecurity，无效果
• 添加自定义过滤器调试请求头，发现只有显式调用request.headerNames.toList()时才会触发请求头名称的校验，因为请求被HttpFirewallRequest内部包装，其重写的getHeaders方法才包含预期的校验逻辑
• 分别使用MockMvc、RestTemplate和Postman发送请求，问题均存在

内容的提问来源于stack exchange，提问作者DgKyK