spring-cloud / spring-cloud/spring-cloud-gateway
Unable to use X-Forwarded-Prefix
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Describe the bug
I think that I have a normal widespread use case of Spring Cloud Gateway (WebFlux version) with a combination of proxy (ingress). I have a proxy (Nginx ingress in Kubernetes) that has a path prefix /api. This prefix is removed from the path and sent as X-Forwarded-Prefix to SCG. SCG has routes without this prefix and striping the next prefix which is an id of another service. See SCG configuration:
spring
cloud:
gateway:
routes:
- id: users
uri: http://localhost:8089
predicates:
- Path= /users/**
filters:
- StripPrefix=1
Then another services (Spring Boot applications) maps the path without these two prefixes e.g. @GetMapping("/foo").
So I have an url /api/users/foo
User /api/users/foo => proxy /users/foo + X-Forwarded-Prefix: /api => SCG /foo + X-Forwarded-Prefix: /api,/users => service
I used server.forward-headers-strategy: NATIVE but the last release updated Reactor Netty that supports X-Forwarded-Prefix https://github.com/reactor/reactor-netty/pull/3436 and it totally broke my configuration.
I would expect that setting server.forward-headers-strategy to NATIVE or FRAMEWORK does not affect routing matching. So if I have the route with the predicate /users it would ignore everything from X-Forwarded-Prefix. But it is not right now. Currently, if there is the forwarded headers strategy then also the matching predicate must contain the prefix /api/users. It looks like it is similar to this ticket https://github.com/spring-projects/spring-framework/issues/25270#issuecomment-654411776 where WebFlux behaved differently for mapping annotations and router functions but it was already fixed and aligned.
The whole problem is with the unsupported context path (base path) in SCG WebFlux https://github.com/spring-cloud/spring-cloud-gateway/issues/1759 because ForwardedHeaderTransformer sets X-Forwarded-Prefix to contextPath.
Then there is also a problem with some filters that are not able to strip the context path: https://github.com/spring-cloud/spring-cloud-gateway/issues/1935
I need to set server.forward-headers-strategy because of Spring Security and correct redirections (in my case I use OAuth2 Login). So I tried these configuration for this properties and none of them worked:
NONE- SCG works but Spring Security redirecting does not work and error responses from SCG do not contain the correct path (because the header is not processed). It correctly sends an additionalX-Forwarded-Prefixthat was striped by the strip prefix filter.FRAMEWORK- I had to change routing predicates and add the prefix and also use custom strip prefix filter with support of removingcontextPathNATIVE- similar toFRAMEWORKbut Spring Security does not handle redirects (it is not issue in SCG) so it is unusable.
Sample
If possible, please provide a test case or sample application that reproduces
the problem. This makes it much easier for us to diagnose the problem and to verify that
we have fixed it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names Spring Cloud Gateway WebFlux routing, ForwardedHeaderTransformer, StripPrefix, and server.forward-headers-strategy; begin by reproducing the /api/users/foo flow with the shown YAML and compare NONE, FRAMEWORK, and NATIVE. Check route matching, prefix stripping, and redirect or error paths, then add regression coverage demonstrating that forwarded prefixes do not alter the route predicate while downstream and security URLs remain correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kubernetes, nginx, spring, spring-boot
- Domain
- api, backend, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100