Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong host port 80 when only "X-Forwarded-Proto: https" is present #2772

Closed
wants to merge 3 commits into from

Conversation

pderop
Copy link
Contributor

@pderop pderop commented Apr 14, 2023

Motivation:
When resolving forwarded headers (X-Forwarded/Forwarded), the following scenario may happen in cloud foundry:

  • you send an https request to a cloud foundry application, for example an actuator request: https://cloudfoundryapplication/actuator
  • the front-end proxy forwards the request to a springboot application on non secure http 8080
  • The request contains a Host header without any port, as well as a `X-Forwarded-Proto: https" header
  • in this case, the DefaultHttpForwardedHeaderHandler class will wrongly resolve the host port as 80 instead of 443, because the request is received on a non-secure connection.
  • And the json response then contains an unexpected 80 port appended in the actuator urls:
{"_links":{"self":{"href":"https://cloudfoundryapplication:80/actuator","templated":false},"health-path":{"href":"https://cloudfoundryapplication:80/actuator/health/{*path}","templated":true},"health": ...

Have also applied the similar patch for Forwarded headers (like Forwarded: proto=https).
Fixes #2771

@pderop pderop added the type/bug A general bug label Apr 14, 2023
@pderop pderop self-assigned this Apr 14, 2023
@pderop pderop added this to the 1.0.32 milestone Apr 14, 2023
@pderop
Copy link
Contributor Author

pderop commented Apr 14, 2023

This PR has been created on top of the main branch, I prefer to recreate one from the 1.0.x branch, then after, I'll merge from 1.0.x into main branch.

@pderop pderop closed this Apr 14, 2023
@pderop pderop removed this from the 1.0.32 milestone Apr 14, 2023
@violetagg violetagg added status/superseded An issue that has been superseded by another and removed type/bug A general bug labels Apr 24, 2023
@violetagg
Copy link
Member

This is superseded by #2773

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status/superseded An issue that has been superseded by another
Projects
None yet
2 participants