Vault performance standby nodes are not honoring `X-Vault-No-Request-Forwarding` header

[Shaeli]

Describe the bug

👋 Hello, I was testing vault performance standby (https://developer.hashicorp.com/vault/tutorials/enterprise/performance-standbys) and wanted to verify the read requests are processed by the performance standby node.

Following https://developer.hashicorp.com/vault/docs/concepts/ha#request-forwarding documentation:

If X-Vault-No-Request-Forwarding header in the request is set to a non-empty value, the standby nodes will redirect the client using a 307 status code to the active node's redirect address.

My understanding is that if I'm using this header, it would allow me to confirm if the requests are handled by the node or redirected as the request transparent forwarding is disabled in favor of an HTTP redirection.

I tested reading a secret on both a performance standby node (with vault enterprise license) and a standby node (OSS version of vault), this is the result:

• Enterprise performance standby node: HTTP 200 with secret content
• OSS standby node: HTTP/2 307 redirection to the vault leader address

Which is what I expected, and confirmed this header is working.

What I don't understand is when I try writing a secret (kv2 secret), with the same header, I get the following result:

• Enterprise performance standby node: HTTP 200 with secret metadatas returned - secret was updated correctly.
• OSS standby node: HTTP/2 307 redirection to the vault leader address

I'm confused as I understood that the performance standby cannot handle write requests (based on the performance standby documentation). Is it not honoring the header or is it processing requests?

To Reproduce

1. Create a vault enterprise cluster with a standby node
2. Enable secret kv2 engine and add a dummy secret
3. Run curl --header "X-Vault-Token: $VAULT_TOKEN" --request POST --data @payload.json --header "X-Vault-No-Request-Forwarding: true" https://${HOSTNAME}:8200/v1/secret-kv2/data/apps/shaeli/_testing on the standby node
4. Get an HTTP 200 instead of a HTTP 307

Expected behavior

I expected a HTTP 307 instead of 200 when doing write requests with the X-Vault-No-Request-Forwarding header on a vault enterprise performance standby node.

[miagilepner]

Hi, performance standby nodes will always use request forwarding, rather than redirects. This is hinted at in the docs but could be clearer

[Shaeli]

Hello @miagilepner , thank you for clarifying this! The documentation is a bit vague on this.

If performance standby nodes always use request forwarding, is there a way to test that my performance standby nodes are working as expected (processing read requests) ?

Thank you

[rowansmithhc]

enable_response_header_hostname and enable_response_header_raft_node_id may be what you are after - https://developer.hashicorp.com/vault/docs/configuration#enable_response_header_hostname

[Shaeli]

@rowansmithhc That's exactly what I was looking for! Thank you !