Class EffectiveOriginResolver

java.lang.Object

com.soklet.EffectiveOriginResolver

@NotThreadSafe
public final class EffectiveOriginResolver
extends Object

Resolves a client's effective origin (scheme + host + optional port) from request headers.

Forwarded headers can be spoofed if Soklet is reachable directly. Choose a EffectiveOriginResolver.TrustPolicy that matches your deployment and, for EffectiveOriginResolver.TrustPolicy.TRUST_PROXY_ALLOWLIST, provide a trusted proxy predicate or allowlist. If the remote address is missing or not trusted, forwarded headers are ignored.

Extraction order is: trusted forwarded headers → Host → (optional) Origin fallback. Origin never overrides a conflicting host value; it only fills missing scheme/port or supplies host when absent.

Defaults: if allowOriginFallback(Boolean) is left unset, Origin fallback is enabled only for EffectiveOriginResolver.TrustPolicy.TRUST_ALL; otherwise it is disabled.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	EffectiveOriginResolver.TrustPolicy	Forwarded header trust policy.

Method Summary

Modifier and Type	Method	Description
@NonNull EffectiveOriginResolver	allowOriginFallback(@Nullable Boolean allowOriginFallback)	Controls whether Origin is used as a fallback signal when determining the client URL prefix.
@NonNull EffectiveOriginResolver	remoteAddress(@Nullable InetSocketAddress remoteAddress)	The remote address of the client connection.
@NonNull Optional<String>	resolve()	Resolves the effective origin.
@NonNull EffectiveOriginResolver	trustedProxyAddresses(@NonNull Set<@NonNull InetAddress> trustedProxyAddresses)	Allows specifying an IP allowlist for trusted proxies.
@NonNull EffectiveOriginResolver	trustedProxyPredicate(@Nullable Predicate<InetSocketAddress> trustedProxyPredicate)	Predicate used when EffectiveOriginResolver.TrustPolicy.TRUST_PROXY_ALLOWLIST is in effect.
static @NonNull EffectiveOriginResolver	withHeaders(@NonNull Map<@NonNull String, @NonNull Set<@NonNull String>> headers, @NonNull EffectiveOriginResolver.TrustPolicy trustPolicy)	Acquires a resolver seeded with raw request headers and a trust policy.
static @NonNull EffectiveOriginResolver	withRequest(@NonNull Request request, @NonNull EffectiveOriginResolver.TrustPolicy trustPolicy)	Acquires a resolver seeded with a Request and a trust policy.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

withHeaders

public static @NonNull EffectiveOriginResolver withHeaders(@NonNull Map<@NonNull String, @NonNull Set<@NonNull String>> headers,
 @NonNull EffectiveOriginResolver.TrustPolicy trustPolicy)

Acquires a resolver seeded with raw request headers and a trust policy.

Parameters:

headers - HTTP request headers

trustPolicy - how forwarded headers should be trusted

Returns:

the resolver

withRequest

public static @NonNull EffectiveOriginResolver withRequest(@NonNull Request request,
 @NonNull EffectiveOriginResolver.TrustPolicy trustPolicy)

Acquires a resolver seeded with a Request and a trust policy.

Parameters:

request - the current request

trustPolicy - how forwarded headers should be trusted

Returns:

the resolver

resolve

public @NonNull Optional<String> resolve()

Resolves the effective origin.

Returns:

the effective origin, or Optional.empty() if it could not be determined

remoteAddress

public @NonNull EffectiveOriginResolver remoteAddress(@Nullable InetSocketAddress remoteAddress)

The remote address of the client connection.

Parameters:

remoteAddress - the remote address, or null if unavailable

Returns:

this resolver

trustedProxyPredicate

public @NonNull EffectiveOriginResolver trustedProxyPredicate(@Nullable Predicate<InetSocketAddress> trustedProxyPredicate)

Predicate used when EffectiveOriginResolver.TrustPolicy.TRUST_PROXY_ALLOWLIST is in effect.

Parameters:

trustedProxyPredicate - predicate that returns true for trusted proxies

Returns:

this resolver

trustedProxyAddresses

public @NonNull EffectiveOriginResolver trustedProxyAddresses(@NonNull Set<@NonNull InetAddress> trustedProxyAddresses)

Allows specifying an IP allowlist for trusted proxies.

Parameters:

trustedProxyAddresses - IP addresses of trusted proxies

Returns:

this resolver

allowOriginFallback

public @NonNull EffectiveOriginResolver allowOriginFallback(@Nullable Boolean allowOriginFallback)

Controls whether Origin is used as a fallback signal when determining the client URL prefix.

Parameters:

allowOriginFallback - true to allow Origin fallback, false to disable it

Returns:

this resolver