如何在Spring Boot中禁用X-Forwarded-Host等指定响应头？

当然可以禁用这些响应头，你当前的Filter没生效，主要是因为只重写了setHeader方法，而Spring设置响应头可能会用到addHeader等其他方法，另外Filter的执行顺序也可能没优先于设置这些头的组件。下面是两种可行的解决方法：

方法一：直接禁用Spring的转发头处理（推荐） #

如果这些头是由Spring自带的ForwardedHeaderFilter添加的，直接在配置文件中禁用该功能即可，从根源上阻止头被添加：

对于Spring MVC应用 #

在application.properties或application.yml中添加：

spring.mvc.forwarded-header-strategy=none

对于Spring WebFlux应用 #

spring.webflux.forwarded-header-strategy=none

方法二：自定义Filter拦截所有设置头的操作 #

如果禁用默认转发头策略不适用，就需要完善自定义Filter，覆盖所有可能设置头的方法，并确保Filter优先级最高：

完整Filter实现 #

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpServletResponseWrapper;
import org.springframework.web.filter.OncePerRequestFilter;
import java.io.IOException;
import java.util.Set;

public class RemoveForwardHeadersFilter extends OncePerRequestFilter {

    private static final Set<String> FORBIDDEN_HEADERS = Set.of(
            "X-Forwarded-Host",
            "X-Host",
            "X-Forwarded-Server"
    );

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        filterChain.doFilter(request, new HttpServletResponseWrapper(response) {
            @Override
            public void setHeader(String name, String value) {
                if (!isForbiddenHeader(name)) {
                    super.setHeader(name, value);
                }
            }

            @Override
            public void addHeader(String name, String value) {
                if (!isForbiddenHeader(name)) {
                    super.addHeader(name, value);
                }
            }

            @Override
            public void setDateHeader(String name, long date) {
                if (!isForbiddenHeader(name)) {
                    super.setDateHeader(name, date);
                }
            }

            @Override
            public void addDateHeader(String name, long date) {
                if (!isForbiddenHeader(name)) {
                    super.addDateHeader(name, date);
                }
            }

            @Override
            public void setIntHeader(String name, int value) {
                if (!isForbiddenHeader(name)) {
                    super.setIntHeader(name, value);
                }
            }

            @Override
            public void addIntHeader(String name, int value) {
                if (!isForbiddenHeader(name)) {
                    super.addIntHeader(name, value);
                }
            }

            private boolean isForbiddenHeader(String name) {
                return FORBIDDEN_HEADERS.stream()
                        .anyMatch(forbidden -> forbidden.equalsIgnoreCase(name));
            }
        });
    }
}

注册Filter并设置最高优先级 #

创建配置类注册Filter，确保它在所有其他Filter之前执行：

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<RemoveForwardHeadersFilter> removeForwardHeadersFilter() {
        FilterRegistrationBean<RemoveForwardHeadersFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new RemoveForwardHeadersFilter());
        registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE);
        return registrationBean;
    }
}

内容的提问来源于stack exchange，提问作者Catalina