Skip to content

[JENKINS-23294] Interpret X-Forwarded-Port #23159

Closed
Bug
Closed
[JENKINS-23294] Interpret X-Forwarded-Port#23159
Bug
Labels
component:coreimported-jira-issuepriority:majorresolution:fixed

Description

@jenkins-infra-bot
jenkins-infra-bot
opened on Jun 3, 2014

Under some conditions a reverse proxy may define X-Forwarded-Port yet the Jenkins servlet container still returns 80 for ServletRequest.getServerPort. This causes problems for computing Jenkins.getRootUrlFromRequest, the current implementation of which treats the default port as 80 regardless of the scheme; we would like the default to be 443 when X-Forwarded-Proto: https, yet this will only work if the servlet container coöperates. Easier to have Jenkins itself interpret this header when set.

Originally reported by jglick, imported from: Interpret X-Forwarded-Port
  • assignee: jglick
  • status: Resolved
  • priority: Major
  • component(s): core
  • label(s): https, proxy
  • resolution: Fixed
  • resolved: 2014-07-07T09:37:21+00:00
  • votes: 0
  • watchers: 3
  • imported: 2025-11-24
Raw content of original issue 
Under some conditions a reverse proxy may define X-Forwarded-Port yet the Jenkins servlet container still returns 80 for ServletRequest.getServerPort. This causes problems for computing Jenkins.getRootUrlFromRequest, the current implementation of which treats the default port as 80 regardless of the scheme; we would like the default to be 443 when X-Forwarded-Proto: https, yet this will only work if the servlet container coöperates. Easier to have Jenkins itself interpret this header when set.

Activity

  1. jenkins-infra-bot commented on Jul 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jul 7, 2014
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Stephen Connolly
Path:
 core/src/main/java/jenkins/model/Jenkins.java
http://jenkins-ci.org/commit/jenkins/5bad446dd51d31efd60538eab5c87bdde57114e9
Log:
  [FIXED JENKINS-23294] Interpret X-Forwarded-Port
      


        
	
      • Also fixed handling of X-Forwarded-Proto and added support for X-Forwarded-Host
        • 

      



        
	
      • Additional complexity is that there can be multiple headers with the same name (which was handled by default by accident) and
  that a header value may contain a comma separated list if there were multiple forwarding hops.
        •

    Code changed in jenkins
    User: Stephen Connolly
    Path:
    core/src/main/java/jenkins/model/Jenkins.java
    http://jenkins-ci.org/commit/jenkins/5bad446dd51d31efd60538eab5c87bdde57114e9
    Log:
    [FIXED JENKINS-23294] Interpret X-Forwarded-Port

    • Also fixed handling of X-Forwarded-Proto and added support for X-Forwarded-Host
    • Additional complexity is that there can be multiple headers with the same name (which was handled by default by accident) and
      that a header value may contain a comma separated list if there were multiple forwarding hops.
  2. jenkins-infra-bot
    closed this as completedon Jul 7, 2014

  3. jenkins-infra-bot commented on Jul 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jul 7, 2014
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Jesse Glick
Path:
 core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
 core/src/main/java/jenkins/model/Jenkins.java
 core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
 test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
http://jenkins-ci.org/commit/jenkins/cffe9df0176b0ff895554ce7f2ea4d2f20062351
Log:
  [FIXED JENKINS-23294] Deal with X-Forwarded-Port.
If this is set, use it instead of ServletRequest.getServerPort() for purposes of getRootUrlFromRequest().
Also treat the default port as scheme-specific in that method (which presumes that we in fact got the reported port right).
And enhance the reverse proxy setup monitor to validate that the Referer header (/manage)
actually matches what we have computed from getRootUrlFromRequest;
if it does not, something is messed up, though it may require some digging to find what.
(Would be better to let the monitor specify the exact problem it determined,
though this is not always actually possible;
for example if you are missing AllowEncodedSlashes NoDecode in Apache,
you just get a 404 from Apache without even getting to Jenkins.)

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
    core/src/main/java/jenkins/model/Jenkins.java
    core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
    test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
    http://jenkins-ci.org/commit/jenkins/cffe9df0176b0ff895554ce7f2ea4d2f20062351
    Log:
    [FIXED JENKINS-23294] Deal with X-Forwarded-Port.
    If this is set, use it instead of ServletRequest.getServerPort() for purposes of getRootUrlFromRequest().
    Also treat the default port as scheme-specific in that method (which presumes that we in fact got the reported port right).
    And enhance the reverse proxy setup monitor to validate that the Referer header (/manage)
    actually matches what we have computed from getRootUrlFromRequest;
    if it does not, something is messed up, though it may require some digging to find what.
    (Would be better to let the monitor specify the exact problem it determined,
    though this is not always actually possible;
    for example if you are missing AllowEncodedSlashes NoDecode in Apache,
    you just get a 404 from Apache without even getting to Jenkins.)

  4. jenkins-infra-bot commented on Jul 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jul 7, 2014
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Stephen Connolly
Path:
 core/src/main/java/jenkins/model/Jenkins.java
http://jenkins-ci.org/commit/jenkins/333b05e356c70e90a7a1eeab9cb7d964c00fcd02
Log:
  [FIXED JENKINS-23294] Interpret X-Forwarded-Port
      


        
	
      • Also fixed handling of X-Forwarded-Proto and added support for X-Forwarded-Host
        • 

      



        
	
      • Additional complexity is that there can be multiple headers with the same name (which was handled by default by accident) and
  that a header value may contain a comma separated list if there were multiple forwarding hops.
        •

    Code changed in jenkins
    User: Stephen Connolly
    Path:
    core/src/main/java/jenkins/model/Jenkins.java
    http://jenkins-ci.org/commit/jenkins/333b05e356c70e90a7a1eeab9cb7d964c00fcd02
    Log:
    [FIXED JENKINS-23294] Interpret X-Forwarded-Port

    • Also fixed handling of X-Forwarded-Proto and added support for X-Forwarded-Host
    • Additional complexity is that there can be multiple headers with the same name (which was handled by default by accident) and
      that a header value may contain a comma separated list if there were multiple forwarding hops.

  5. jenkins-infra-bot commented on Jul 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jul 7, 2014
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Stephen Connolly
Path:
 core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
 core/src/main/java/jenkins/model/Jenkins.java
 core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
 test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
 test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
 test/src/test/java/jenkins/security/RekeySecretAdminMonitorTest.java
http://jenkins-ci.org/commit/jenkins/a239197a8fd17e3831af36bfb9b3c90c550a9bb1
Log:
  Merge pull request #1294 from jenkinsci/pull/1265/head
      


      [FIXED JENKINS-23294] Interpret X-Forwarded-Port
      



      Compare: f277502...a239197

    Code changed in jenkins
    User: Stephen Connolly
    Path:
    core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
    core/src/main/java/jenkins/model/Jenkins.java
    core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
    test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
    test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
    test/src/test/java/jenkins/security/RekeySecretAdminMonitorTest.java
    http://jenkins-ci.org/commit/jenkins/a239197a8fd17e3831af36bfb9b3c90c550a9bb1
    Log:
    Merge pull request #1294 from /pull/1265/head

    [FIXED JENKINS-23294] Interpret X-Forwarded-Port

    Compare: f277502...a239197

  6. jenkins-infra-bot commented on Jul 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jul 7, 2014
    Author
    dogfood:
    • Original comment link
    • Raw content of original comment: 
      Integrated in  jenkins_main_trunk #3498
     [FIXED JENKINS-23294] Interpret X-Forwarded-Port (Revision 5bad446dd51d31efd60538eab5c87bdde57114e9)
[FIXED JENKINS-23294] Deal with X-Forwarded-Port. (Revision cffe9df0176b0ff895554ce7f2ea4d2f20062351)
      


           Result = SUCCESS
Stephen Connolly : 5bad446dd51d31efd60538eab5c87bdde57114e9
Files : 
      

        
	
      • core/src/main/java/jenkins/model/Jenkins.java
        • 

      



      Stephen Connolly : cffe9df0176b0ff895554ce7f2ea4d2f20062351
Files : 
      

        
	
      • core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
        • 
	
      • core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
        • 
	
      • test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
        • 
	
      • core/src/main/java/jenkins/model/Jenkins.java
        •

    Integrated in jenkins_main_trunk #3498
    [FIXED JENKINS-23294] Interpret X-Forwarded-Port (Revision 5bad446)
    [FIXED JENKINS-23294] Deal with X-Forwarded-Port. (Revision cffe9df)

    Result = SUCCESS
    Stephen Connolly : 5bad446dd51d31efd60538eab5c87bdde57114e9
    Files :

    • core/src/main/java/jenkins/model/Jenkins.java

    Stephen Connolly : cffe9df0176b0ff895554ce7f2ea4d2f20062351
    Files :

    • core/src/test/java/jenkins/model/JenkinsGetRootUrlTest.java
    • core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java
    • test/src/test/java/hudson/diagnosis/ReverseProxySetupMonitorTest.java
    • core/src/main/java/jenkins/model/Jenkins.java

  7. jenkins-infra-bot commented on Jan 15, 2016

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jan 15, 2016
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Stephen Connolly
    Path:
    test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
    http://jenkins-ci.org/commit/jenkins-test-harness/81ccc04db253c5e14c52c49e82416e8538fdefc6
    Log:
    Merge pull request #1294 from /pull/1265/head

    [FIXED JENKINS-23294] Interpret X-Forwarded-Port
    Originally-Committed-As: a239197

  8. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-10675]

  9. jenkins-infra-bot
    added
    bugFor changelog: Minor bug. Will be listed after features
    imported-jira-issue
    on Nov 24, 2025

  10. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original depends_on from Jira: JENKINS-31068]

  11. jenkins-infra-bot
    added
    component:core
    priority:major
    resolution:fixed
    on Nov 24, 2025
  12. jenkins-infra-bot
    added the
    Bug
    issue type on Nov 25, 2025
  13. jenkins-infra-bot
    removed
    bugFor changelog: Minor bug. Will be listed after features
    on Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:coreimported-jira-issuepriority:majorresolution:fixed

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions