Add X-Forwarded-For proxy header

[mikejhill]

Targeting this fork since it seems to be the most active of UrlRewriteFilter and has been a really helpful fork for us so far (thank you for your work!).

This tries to fix an issue into where (reverse-)proxying doesn't include the X-Forwarded-For header. This header propagates the original client IP to downstream targets. This need for us comes out of a simple (Atlassian Crowd) SSO solution that requires validating an SSO token against a matching client IP. Hosts need to see the real client IP during proxied requests rather than just the proxy (UrlRewriteFilter) server's IP.

MDN X-Forwarded-For page: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

There seems to be some question on whether X-Forwarded-For or X-Real-IP is a better header to use (source). However, MDN doesn't list X-Real-IP, and I don't seem to see it used as often in other places. The Tomcat RemoteIpValve uses X-Forwarded-For, X-Forwarded-By, and X-Forwarded-Proto only, by default. NGINX mentions X-Real-IP in some of their guides, but seems to prefer X-Forwarded-For (e.g., $proxy_add_x_forwarded_for). I don't see any mention of X-Real-IP in the org.apache.tomcat:tomcat-catalina:9.0.30 source.

[machak]

@mikejhill thanks for the patch, I'll review it tomorrow.
I believe we use X-Forwarded-For header in our stack (we can always add an option to make it configurable)

[machak]

Code looks ok other than part I commented (appending first address as last again)

[boudekerk]

The options's called addProxyHeaders, so should X-Forwarded-Proto and X-Forwarded-Host then be forwarded/appended as well?

[mikejhill]

The options's called addProxyHeaders, so should X-Forwarded-Proto and X-Forwarded-Host then be forwarded/appended as well?

I've added additional options for X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-By, and Host (for manually propagating the host value) now. I also changed the add-proxy-headers DTD to accept a comma-delimited list of which of these headers to use.

I found myself needing differing headers depending on my configuration. For example, RemoteIpValve in Tomcat 9.0.20 doesn't support X-Forwarded-Host, so Host must be propagated manually. Tomcat 9.0.23 added support (https://bz.apache.org/bugzilla/show_bug.cgi?id=57665#c24), so in those cases we would prefer to use X-Forwarded-Host rather than change the real host header.

[mikejhill]

Made some minor updates, added X-Forwarded-Prefix support, and added simple tests. I believe existing comments are resolved.