zuul的ignoredHeaders和sensitiveHeaders配置详解

搜索了网上的一些资料，发现各有各的解释，且解释的不太清楚。
查看了zuul的源码后得出结论：

1. 俩个配置都是用来过滤header的，只不过sensitiveHeaders不配置时，会有三个默认过滤的header头。
2. 不做任何配置的情况下，header会全部往下转发，除了Cookie、Set-Cookie、Authorization
3. 无论是配置ignoredHeaders和sensitiveHeaders都会在转发时过滤掉
4. ignoredHeaders只有zuul.ignoredHeaders的全局配置
5. sensitiveHeaders有zuul.sensitiveHeaders的全局配置和zuul.routes.xxxrouteId.sensitiveHeaders的私有配置

相关源码如下：

public class ZuulProperties {
	...
	//sensitiveHeaders的默认三个过滤header配置
	private Set<String> sensitiveHeaders = new LinkedHashSet<>(
			Arrays.asList("Cookie", "Set-Cookie", "Authorization"));
	...
}

sensitiveHeaders配置会在请求经过PreDecorationFilter过滤器时合并到ProxyRequestHelper对象的ignoredHeaders中：

				//PreDecorationFilter的122行
				if (!route.isCustomSensitiveHeaders()) {
					this.proxyRequestHelper
							.addIgnoredHeaders(this.properties.getSensitiveHeaders().toArray(new String[0]));
				}
				else {
					this.proxyRequestHelper.addIgnoredHeaders(route.getSensitiveHeaders().toArray(new String[0]));
				}

最终往下转发的header是在SimpleHostRoutingFilter或RibbonRoutingFilter中生成：

//RibbonRoutingFilter的129行
MultiValueMap<String, String> headers = this.helper
				.buildZuulRequestHeaders(request);

//SimpleHostRoutingFilter的201行
MultiValueMap<String, String> headers = this.helper
				.buildZuulRequestHeaders(request);

可以看到最终都是通过ProxyRequestHelper的buildZuulRequestHeaders生成：

	public MultiValueMap<String, String> buildZuulRequestHeaders(
			HttpServletRequest request) {
		RequestContext context = RequestContext.getCurrentContext();
		MultiValueMap<String, String> headers = new HttpHeaders();
		Enumeration<String> headerNames = request.getHeaderNames();
		if (headerNames != null) {
			while (headerNames.hasMoreElements()) {
				String name = headerNames.nextElement();
				//通过isIncludedHeader方法过滤
				if (isIncludedHeader(name)) {
					Enumeration<String> values = request.getHeaders(name);
					while (values.hasMoreElements()) {
						String value = values.nextElement();
						headers.add(name, value);
					}
				}
			}
		}
		Map<String, String> zuulRequestHeaders = context.getZuulRequestHeaders();
		for (String header : zuulRequestHeaders.keySet()) {
			if (isIncludedHeader(header)){
				headers.set(header, zuulRequestHeaders.get(header));
			}
		}
		if(!headers.containsKey(HttpHeaders.ACCEPT_ENCODING)) {
			headers.set(HttpHeaders.ACCEPT_ENCODING, "gzip");
		}
		return headers;
	}

isIncludedHeader方法：

	public boolean isIncludedHeader(String headerName) {
		String name = headerName.toLowerCase();
		RequestContext ctx = RequestContext.getCurrentContext();
		if (ctx.containsKey(IGNORED_HEADERS)) {
			Object object = ctx.get(IGNORED_HEADERS);
			//在IGNORED_HEADERS中的header会被过滤掉
			if (object instanceof Collection && ((Collection<?>) object).contains(name)) {
				return false;
			}
		}
		switch (name) {
		case "host":
			if(addHostHeader) {
				return true;
			}
		case "connection":
		case "content-length":
		case "server":
		case "transfer-encoding":
		case "x-application-context":
			return false;
		default:
			return true;
		}
	}