codeconsole commented on PR #16408: URL: https://github.com/apache/grails-core/pull/16408#issuecomment-6127100256
Two more commits pick up Spring Boot 4.2 and Spring Framework 7.1 changes: - e378140fde: `GrailsSecurityHeadersFilter` reads the forwarded scheme for its HSTS decision with Framework 7.1's `ForwardedHeaderUtils.parseStandardHeader` and `parseXForwardedHeaders` instead of `adaptFromForwardedHeaders`, which 7.1 deprecates for removal. `Forwarded` still takes precedence over `X-Forwarded-*`. Two edge cases change, both for HSTS only, which user agents ignore on a plain connection: `X-Forwarded-Ssl` is no longer consulted next to a `Forwarded` header without `proto`, and a malformed `for` or `by` address now invalidates the `Forwarded` header. The spec covers both, plus obfuscated and quoted IPv6 `for` values. - 426e7362ad: the Grails 8 to Grails 9 upgrade guide lists the Spring Boot 4.2 and Spring Framework 7.1 changes most likely to reach a Grails application: `forward-headers-strategy: framework` reading only `X-Forwarded-*` by default, with the filter now registered by `WebMvcAutoConfiguration` (so an application declaring `@EnableWebMvc` no longer gets it); relative redirect locations from embedded Tomcat (`chain` is affected, `redirect` is not); `TestRestTemplate` deprecated in favor of `RestTestClient`; the JAXB converter no longer auto-detected; and static nested `@Configuration` classes loaded from test superclasses. The deployment guide's reverse-proxy section names `spring.mvc.forwarded-headers.header-format`. Both landed after the approval, so a second look would be appreciated. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
