spring-cloud / spring-cloud/spring-cloud-gateway
RequestSize filter only works when client sends Content-Length header
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Describe the bug
In the case of a client doesn't send the Content-Length header in advance, the gateway's RequestSize filter doesn't actually filter for the request body size, and the full request body is sent to the proxied server.
This could easily happen if the client uses HTTP/2 or even HTTP/1.1 with Content-Encoding: chunked, in which case the Content-Length header is not required, and should not be sent.
This is unexpected, compared to the documentation, which doesn't mention that only the the header is checked.
Sample
This test case shows the problem (will fail):
package org.springframework.cloud.gateway.filter.factory;
/// ...
@SpringBootTest(webEnvironment = RANDOM_PORT)
@DirtiesContext
public class RequestSizeGatewayFilterFactoryTest extends BaseWebClientTests {
// ...
@Test
public void setRequestSizeFilterWorksForStreams() {
testClient.post()
.uri("/post")
.header("Host", "www.setrequestsize.org")
.bodyValue(
new InputStreamResource(
new ByteArrayInputStream("123456".getBytes())))
.exchange()
.expectStatus()
.isEqualTo(HttpStatus.PAYLOAD_TOO_LARGE)
.expectHeader()
.valueMatches("errorMessage", responseMesssage);
}
// ...
}
Expected behaviour
The gateway filter should wrap the request body flux, count the bytes passed through, and return an error response in case of a request body exceeding the set size. Ideally the request against the proxied service should be dropped (if committed).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with RequestSizeGatewayFilterFactoryTest and run the setRequestSizeFilterWorksForStreams test to reproduce the failure without a Content-Length header. Trace the RequestSize filter implementation from that test and verify that oversized streamed bodies are rejected with PAYLOAD_TOO_LARGE before the full body reaches the proxied service.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100