spring-cloud / spring-cloud/spring-cloud-gateway
X-Forwarded-For not forwarded correctly by Spring Cloud Gateway 4.3.0 after upgrading to Spring Cloud 2025.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Hi spring cloud gateway team,
After upgrading to Spring Cloud 2025, I found that Spring Cloud Gateway 4.3.0 does not correctly forward the X-Forwarded-For header.
Expected behavior:
Spring Cloud Gateway should forward the real client IP in X-Forwarded-For to microservices.
Actual behavior:
Using tcpdump, I observed that Gateway WebFlux 4.3.0 (included in Spring Cloud 2025) does not forward X-Forwarded-For at all.
Configuration tried:
I set the following property as suggested in the docs:
spring.cloud.gateway.server.webflux.trusted-proxies=10\.\\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|100\.6[4-9]{1}\.\d{1,3}\.\d{1,3}|100\.[7-9]{1}\d{1}\.\d{1,3}\.\d{1,3}|100\.1[0-1]{1}\d{1}\.\d{1,3}\.\d{1,3}|100\.12[0-7]{1}\.\d{1,3}\.\d{1,3}|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}|0:0:0:0:0:0:0:1|::1|fe[89ab]\p{XDigit}:.*|f[cd]\p{XDigit}{2}:.*+
But it has no effect.
As I understand, this config is for trusting other proxies. In my case, users access Spring Cloud Gateway directly (no proxy).
Question:
How can I configure Spring Cloud Gateway so that it always forwards the real client IP as X-Forwarded-For to downstream services?
Thanks!!!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with Spring Cloud Gateway 4.3.0, the shown trusted-proxies setting, and tcpdump while checking the downstream service. Investigate how WebFlux handles X-Forwarded-For when users connect directly rather than through a trusted proxy. Done means the real client IP is forwarded consistently or the supported configuration and limitation are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100