spring-cloud / spring-cloud/spring-cloud-gateway

Unable to use X-Forwarded-Prefix

Open
#3,635 9 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

feedback-provided
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Describe the bug
I think that I have a normal widespread use case of Spring Cloud Gateway (WebFlux version) with a combination of proxy (ingress). I have a proxy (Nginx ingress in Kubernetes) that has a path prefix /api. This prefix is removed from the path and sent as X-Forwarded-Prefix to SCG. SCG has routes without this prefix and striping the next prefix which is an id of another service. See SCG configuration:

spring
  cloud:
    gateway:
      routes:
      - id: users
        uri: http://localhost:8089
        predicates:
          - Path= /users/**
        filters:
          - StripPrefix=1

Then another services (Spring Boot applications) maps the path without these two prefixes e.g. @GetMapping("/foo").

So I have an url /api/users/foo

User /api/users/foo => proxy /users/foo + X-Forwarded-Prefix: /api => SCG /foo + X-Forwarded-Prefix: /api,/users => service
SCG X-Forwarded-Prefix

I used server.forward-headers-strategy: NATIVE but the last release updated Reactor Netty that supports X-Forwarded-Prefix https://github.com/reactor/reactor-netty/pull/3436 and it totally broke my configuration.

I would expect that setting server.forward-headers-strategy to NATIVE or FRAMEWORK does not affect routing matching. So if I have the route with the predicate /users it would ignore everything from X-Forwarded-Prefix. But it is not right now. Currently, if there is the forwarded headers strategy then also the matching predicate must contain the prefix /api/users. It looks like it is similar to this ticket https://github.com/spring-projects/spring-framework/issues/25270#issuecomment-654411776 where WebFlux behaved differently for mapping annotations and router functions but it was already fixed and aligned.

The whole problem is with the unsupported context path (base path) in SCG WebFlux https://github.com/spring-cloud/spring-cloud-gateway/issues/1759 because ForwardedHeaderTransformer sets X-Forwarded-Prefix to contextPath.
Then there is also a problem with some filters that are not able to strip the context path: https://github.com/spring-cloud/spring-cloud-gateway/issues/1935

I need to set server.forward-headers-strategy because of Spring Security and correct redirections (in my case I use OAuth2 Login). So I tried these configuration for this properties and none of them worked:

  • NONE - SCG works but Spring Security redirecting does not work and error responses from SCG do not contain the correct path (because the header is not processed). It correctly sends an additional X-Forwarded-Prefix that was striped by the strip prefix filter.
  • FRAMEWORK - I had to change routing predicates and add the prefix and also use custom strip prefix filter with support of removing contextPath
  • NATIVE - similar to FRAMEWORK but Spring Security does not handle redirects (it is not issue in SCG) so it is unusable.

Sample
If possible, please provide a test case or sample application that reproduces
the problem. This makes it much easier for us to diagnose the problem and to verify that
we have fixed it.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names Spring Cloud Gateway WebFlux routing, ForwardedHeaderTransformer, StripPrefix, and server.forward-headers-strategy; begin by reproducing the /api/users/foo flow with the shown YAML and compare NONE, FRAMEWORK, and NATIVE. Check route matching, prefix stripping, and redirect or error paths, then add regression coverage demonstrating that forwarded prefixes do not alter the route predicate while downstream and security URLs remain correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kubernetes, nginx, spring, spring-boot
Domain
api, backend, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.