SITES-49845: Adds configurable forwarding of client IP and other request headers to Commerce

Author: alwinjoseph02

bundles/core/src/main/java/com/adobe/cq/commerce/core/components/internal/client/ForwardedHeadersConfig.java

@@ -0,0 +1,76 @@
+/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~ Copyright 2026 Adobe
+ ~
+ ~ Licensed under the Apache License, Version 2.0 (the "License");
+ ~ you may not use this file except in compliance with the License.
+ ~ You may obtain a copy of the License at
+ ~
+ ~     http://www.apache.org/licenses/LICENSE-2.0
+ ~
+ ~ Unless required by applicable law or agreed to in writing, software
+ ~ distributed under the License is distributed on an "AS IS" BASIS,
+ ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ ~ See the License for the specific language governing permissions and
+ ~ limitations under the License.
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
+package com.adobe.cq.commerce.core.components.internal.client;
+
+import org.osgi.service.metatype.annotations.AttributeDefinition;
+import org.osgi.service.metatype.annotations.ObjectClassDefinition;
+
+/**
+ * Single configuration covering all forwarding of incoming request headers to the outbound Commerce GraphQL
+ * request: a master switch, an arbitrary list of headers forwarded as-is, and a dedicated client IP section with
+ * its own switch and fields (source header/pattern/outbound name), since the client IP needs more than a plain
+ * name to be forwarded correctly. Every header forwarded through this configuration, generic or client IP, is
+ * excluded from the GraphQL response cache key, since it carries per-request metadata that does not influence the
+ * response. Headers on the internal denylist (Authorization, Cookie, Host, Content-Length, etc.) are never
+ * forwarded, even if configured here.
+ */
+@ObjectClassDefinition(name = "CIF Forwarded Request Headers Configuration")
+public @interface ForwardedHeadersConfig {
+
+    @AttributeDefinition(
+        name = "Enabled",
+        description = "Master switch for all header forwarding configured below. Disable to turn everything off without "
+            + "clearing the individual fields.")
+    boolean enabled() default false;
+
+    @AttributeDefinition(
+        name = "Forwarded header names",
+        description = "Names of incoming request headers whose current value should be forwarded as-is, under the same name, on "
+            + "the outbound GraphQL request to Commerce (e.g. a tracing/correlation id header).")
+    String[] forwardedHeaderNames() default {};
+
+    @AttributeDefinition(
+        name = "Enable client IP forwarding",
+        description = "Forwards the end-user IP using the dedicated fields below, in addition to any generic headers above. Only "
+            + "enable this once the CDN/dispatcher in front of AEM is confirmed to set the source header from the actual client "
+            + "connection, not from an unvalidated client-supplied value.")
+    boolean clientIpEnabled() default false;
+
+    @AttributeDefinition(
+        name = "Client IP header name",
+        description = "Incoming request header set by the CDN/edge/dispatcher that carries the original client IP. Defaults to "
+            + "the standard 'X-Forwarded-For', already populated by the AEMaaCS managed CDN and by common on-premise "
+            + "dispatcher/reverse-proxy setups. Different CDNs may use a dedicated header instead, e.g. 'CF-Connecting-IP' "
+            + "(Cloudflare), 'True-Client-IP' (Akamai), 'Fastly-Client-IP' (Fastly). The reserved value 'REMOTE_ADDR' reads the "
+            + "direct TCP connection IP instead of a header: only correct when AEM is reached with no proxy/CDN/dispatcher in "
+            + "between (e.g. local development), since behind any proxy this would instead resolve to that proxy's own IP.")
+    String clientIpHeaderName() default "X-Forwarded-For";
+
+    @AttributeDefinition(
+        name = "Client IP outbound header name",
+        description = "Header name used to forward the client IP on the outbound Commerce request, so it never collides with a "
+            + "header name already used for another purpose between AEM and Commerce.")
+    String clientIpOutboundHeaderName() default "X-Adobe-Client-IP";
+
+    @AttributeDefinition(
+        name = "Client IP value extraction pattern",
+        description = "Regex with a single capturing group used to extract the client IP from the header value above. The "
+            + "default pattern takes the leftmost token, which works for a plain single-IP header (e.g. 'CF-Connecting-IP') as "
+            + "well as a multi-hop 'X-Forwarded-For' chain ('client, proxy1, proxy2'). Use 'for=\"?\\[?([0-9a-fA-F:.]+)' for the "
+            + "standards-based 'Forwarded' header (RFC 7239), or '^([0-9a-fA-F:.]+):\\d+$' to strip a trailing port, e.g. "
+            + "CloudFront's 'CloudFront-Viewer-Address'.")
+    String clientIpHeaderValuePattern() default "^\\s*([0-9a-fA-F:.]+)";
+}

bundles/core/src/main/java/com/adobe/cq/commerce/core/components/internal/client/ForwardedHeadersConfigService.java

@@ -0,0 +1,103 @@
+/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~ Copyright 2026 Adobe
+ ~
+ ~ Licensed under the Apache License, Version 2.0 (the "License");
+ ~ you may not use this file except in compliance with the License.
+ ~ You may obtain a copy of the License at
+ ~
+ ~     http://www.apache.org/licenses/LICENSE-2.0
+ ~
+ ~ Unless required by applicable law or agreed to in writing, software
+ ~ distributed under the License is distributed on an "AS IS" BASIS,
+ ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ ~ See the License for the specific language governing permissions and
+ ~ limitations under the License.
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
+package com.adobe.cq.commerce.core.components.internal.client;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
+
+import org.apache.commons.lang3.StringUtils;
+import org.osgi.service.component.annotations.Activate;
+import org.osgi.service.component.annotations.Component;
+import org.osgi.service.metatype.annotations.Designate;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Holds the {@link ForwardedHeadersConfig} in a form ready to use by {@link MagentoGraphqlClientImpl}: the client
+ * IP pattern is pre-compiled once here rather than on every request, and an invalid pattern disables client IP
+ * forwarding instead of failing GraphQL requests at runtime.
+ */
+@Component(service = ForwardedHeadersConfigService.class)
+@Designate(ocd = ForwardedHeadersConfig.class)
+public class ForwardedHeadersConfigService {
+
+    /**
+     * Reserved {@link ForwardedHeadersConfig#clientIpHeaderName()} value: read the direct TCP connection IP
+     * instead of a header. Only correct with no proxy/CDN/dispatcher in front of AEM (e.g. local development).
+     */
+    static final String REMOTE_ADDR = "REMOTE_ADDR";
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(ForwardedHeadersConfigService.class);
+
+    private boolean enabled;
+    private Set<String> forwardedHeaderNames = Collections.emptySet();
+    private boolean clientIpEnabled;
+    private String clientIpHeaderName;
+    private String clientIpOutboundHeaderName;
+    private Pattern clientIpHeaderValuePattern;
+
+    @Activate
+    protected void activate(ForwardedHeadersConfig config) {
+        this.enabled = config.enabled();
+
+        String[] configuredNames = config.forwardedHeaderNames();
+        this.forwardedHeaderNames = configuredNames != null && configuredNames.length > 0
+            ? new LinkedHashSet<>(Arrays.asList(configuredNames))
+            : Collections.emptySet();
+
+        this.clientIpEnabled = config.clientIpEnabled();
+        this.clientIpHeaderName = config.clientIpHeaderName();
+        this.clientIpOutboundHeaderName = StringUtils.isNotBlank(config.clientIpOutboundHeaderName())
+            ? config.clientIpOutboundHeaderName()
+            : config.clientIpHeaderName();
+
+        try {
+            this.clientIpHeaderValuePattern = Pattern.compile(config.clientIpHeaderValuePattern());
+        } catch (PatternSyntaxException e) {
+            LOGGER.error("Invalid client IP header value pattern '{}', client IP forwarding is disabled",
+                config.clientIpHeaderValuePattern(), e);
+            this.clientIpEnabled = false;
+        }
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public Set<String> getForwardedHeaderNames() {
+        return forwardedHeaderNames;
+    }
+
+    public boolean isClientIpEnabled() {
+        return clientIpEnabled;
+    }
+
+    public String getClientIpHeaderName() {
+        return clientIpHeaderName;
+    }
+
+    public String getClientIpOutboundHeaderName() {
+        return clientIpOutboundHeaderName;
+    }
+
+    public Pattern getClientIpHeaderValuePattern() {
+        return clientIpHeaderValuePattern;
+    }
+}

bundles/core/src/main/java/com/adobe/cq/commerce/core/components/internal/client/MagentoGraphqlClientImpl.java

@@ -21,13 +21,16 @@
 import java.util.Calendar;
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.TimeZone;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 import javax.annotation.PostConstruct;
@@ -41,6 +44,7 @@
 import org.apache.sling.api.resource.ResourceResolver;
 import org.apache.sling.models.annotations.Model;
 import org.apache.sling.models.annotations.injectorspecific.InjectionStrategy;
+import org.apache.sling.models.annotations.injectorspecific.OSGiService;
 import org.apache.sling.models.annotations.injectorspecific.ScriptVariable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -92,6 +96,11 @@ public class MagentoGraphqlClientImpl implements MagentoGraphqlClient {
     private Resource resource;
     @ScriptVariable(injectionStrategy = InjectionStrategy.OPTIONAL)
     private Page currentPage;
+    // Admin-configured forwarding of incoming request headers (generic headers, plus a dedicated client IP
+    // section) to the outbound Commerce request. Which header/source and how to parse the client IP differs per
+    // CDN/dispatcher (AEMaaCS vs. on-premise, and across CDN vendors), hence configuration, not hardcoded here.
+    @OSGiService(injectionStrategy = InjectionStrategy.OPTIONAL)
+    private ForwardedHeadersConfigService forwardedHeadersConfigService;
 
     private GraphqlClient graphqlClient;
     private RequestOptions requestOptions;
@@ -208,6 +217,20 @@ private void initModel(Resource resource, Page page, SlingHttpServletRequest req
             httpMethod = HttpMethod.POST;
         }
 
+        // Headers carrying per-request metadata (client IP, forwarded tracing/correlation ids, ...) must not
+        // influence the GraphQL response cache key, since they do not affect the response itself.
+        Set<String> nonCacheKeyHeaderNames = new HashSet<>();
+
+        if (request != null && forwardedHeadersConfigService != null && forwardedHeadersConfigService.isEnabled()) {
+            // Checked separately from the generic forwarded headers below, since the client IP needs its own
+            // source pattern and outbound name rather than a plain same-name pass-through.
+            if (forwardedHeadersConfigService.isClientIpEnabled()) {
+                applyClientIpForwarding(request, forwardedHeadersConfigService, headers, nonCacheKeyHeaderNames);
+            }
+
+            applyGenericHeaderForwarding(request, forwardedHeadersConfigService, headers, nonCacheKeyHeaderNames);
+        }
+
         this.httpHeaders = headers;
         // In certain situations resource.getResourceType() returns an enforced resource type.
         // We prefer the resource type of the component proxy for the cache name.
@@ -218,6 +241,7 @@ private void initModel(Resource resource, Page page, SlingHttpServletRequest req
                 .withCacheName(cacheName)
                 .withDataFetchingPolicy(DataFetchingPolicy.CACHE_FIRST))
             .withHeaders(headers.size() > 0 ? headers : null)
+            .withNonCacheKeyHeaderNames(nonCacheKeyHeaderNames)
             .withHttpMethod(httpMethod);
 
         if (request != null) {
@@ -361,6 +385,85 @@ private static List<Header> getCustomHttpHeaders(ComponentsConfiguration configu
         return headers;
     }
 
+    /**
+     * Forwards the client IP using the dedicated source header/pattern/outbound name from
+     * {@link ForwardedHeadersConfig}, since the client IP needs more than a plain same-name pass-through: a source
+     * that may be {@code REMOTE_ADDR}, a value extraction pattern, and typically a different outbound name.
+     */
+    private static void applyClientIpForwarding(SlingHttpServletRequest request, ForwardedHeadersConfigService config,
+        List<Header> headers, Set<String> nonCacheKeyHeaderNames) {
+        String outboundHeaderName = config.getClientIpOutboundHeaderName();
+        String value = readRequestValue(request, config.getClientIpHeaderName(), config.getClientIpHeaderValuePattern());
+        addForwardedHeader(outboundHeaderName, value, headers, nonCacheKeyHeaderNames);
+    }
+
+    /**
+     * Forwards each configured generic header (e.g. a tracing/correlation id) as-is, under the same name, with no
+     * value extraction pattern. Kept separate from client IP forwarding above so each stays simple to read.
+     */
+    private static void applyGenericHeaderForwarding(SlingHttpServletRequest request, ForwardedHeadersConfigService config,
+        List<Header> headers, Set<String> nonCacheKeyHeaderNames) {
+        for (String headerName : config.getForwardedHeaderNames()) {
+            String value = readRequestValue(request, headerName, null);
+            addForwardedHeader(headerName, value, headers, nonCacheKeyHeaderNames);
+        }
+    }
+
+    /**
+     * Adds {@code value} to {@code headers} under {@code outboundHeaderName} and marks it as excluded from the
+     * response cache key, unless the value is missing, the name is denylisted, or a header with that name is
+     * already present (a statically configured header always takes precedence).
+     */
+    private static void addForwardedHeader(String outboundHeaderName, String value, List<Header> headers,
+        Set<String> nonCacheKeyHeaderNames) {
+        if (value == null) {
+            return;
+        }
+        if (DENIED_HEADERS.contains(outboundHeaderName.toLowerCase(Locale.ROOT))) {
+            LOGGER.warn("Ignoring denylisted outbound header '{}' configured for forwarding", outboundHeaderName);
+            return;
+        }
+        if (headers.stream().noneMatch(header -> header.getName().equalsIgnoreCase(outboundHeaderName))) {
+            headers.add(new BasicHeader(outboundHeaderName, value));
+            nonCacheKeyHeaderNames.add(outboundHeaderName);
+        }
+    }
+
+    /**
+     * Reads the value to forward from the configured source: either the direct TCP connection IP
+     * ({@code REMOTE_ADDR}), or the named incoming header, optionally parsed with a pattern. A {@code null}
+     * pattern means the header's raw value is forwarded as-is. Which source to read, and how to parse it, is
+     * configuration ({@link ForwardedHeadersConfig}) rather than hardcoded here, since different CDNs/dispatchers
+     * in front of AEM (AEMaaCS vs. on-premise, and across CDN vendors) expose values like the client IP
+     * differently.
+     */
+    private static String readRequestValue(SlingHttpServletRequest request, String headerName, Pattern headerValuePattern) {
+        if (StringUtils.isBlank(headerName)) {
+            return null;
+        }
+
+        if (ForwardedHeadersConfigService.REMOTE_ADDR.equalsIgnoreCase(headerName)) {
+            return StringUtils.trimToNull(request.getRemoteAddr());
+        }
+
+        String headerValue = StringUtils.trimToNull(request.getHeader(headerName));
+        if (headerValue == null) {
+            return null;
+        }
+
+        if (headerValuePattern == null) {
+            return headerValue;
+        }
+
+        Matcher matcher = headerValuePattern.matcher(headerValue);
+        if (matcher.find()) {
+            return matcher.group(1);
+        }
+
+        LOGGER.warn("Could not extract a value from header '{}' using the configured pattern", headerName);
+        return null;
+    }
+
     private static Long getTimeWarpEpoch(SlingHttpServletRequest request) {
         String timeWarp = request.getParameter("timewarp");
         if (timeWarp == null) {