public boolean isTrusted ( String hostAddr , String headerName ) { if ( ! wcTrusted ) { return false ; } if ( HttpHeaderKeys . isSensitivePrivateHeader ( headerName ) ) { // if this is a sensitive private header, check trustedSensitiveHeaderOrigin values return isTrustedForSensitiveHeaders ( hostAddr ) ; } if ( ! usePrivateHeaders ) { // trustedHeaderOrigin list is explicitly set to "none" return isTrustedForSensitiveHeaders ( hostAddr ) ; } if ( restrictPrivateHeaderOrigin == null ) { // trustedHeaderOrigin list is set to "*" return true ; } else { // check trustedHeaderOrigin for given host IP boolean trustedOrigin = restrictPrivateHeaderOrigin . contains ( hostAddr . toLowerCase ( ) ) ; if ( ! trustedOrigin ) { // if hostAddr is not in trustedHeaderOrigin, allow trustedSensitiveHeaderOrigin to override trust trustedOrigin = isTrustedForSensitiveHeaders ( hostAddr ) ; } return trustedOrigin ; } }
Check to see if the source host address is one we allow for specification of private headers