spring-cloud / spring-cloud/spring-cloud-gateway

RequestSize filter only works when client sends Content-Length header

Open
#3,843 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feedback-provided
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Describe the bug
In the case of a client doesn't send the Content-Length header in advance, the gateway's RequestSize filter doesn't actually filter for the request body size, and the full request body is sent to the proxied server.

This could easily happen if the client uses HTTP/2 or even HTTP/1.1 with Content-Encoding: chunked, in which case the Content-Length header is not required, and should not be sent.

This is unexpected, compared to the documentation, which doesn't mention that only the the header is checked.

Sample

This test case shows the problem (will fail):

package org.springframework.cloud.gateway.filter.factory;

/// ...
@SpringBootTest(webEnvironment = RANDOM_PORT)
@DirtiesContext
public class RequestSizeGatewayFilterFactoryTest extends BaseWebClientTests {

        // ...

	@Test
	public void setRequestSizeFilterWorksForStreams() {
		testClient.post()
				.uri("/post")
				.header("Host", "www.setrequestsize.org")
				.bodyValue(
                                    new InputStreamResource(
                                         new ByteArrayInputStream("123456".getBytes())))
				.exchange()
				.expectStatus()
				.isEqualTo(HttpStatus.PAYLOAD_TOO_LARGE)
				.expectHeader()
				.valueMatches("errorMessage", responseMesssage);
	}

        // ...
}

Expected behaviour
The gateway filter should wrap the request body flux, count the bytes passed through, and return an error response in case of a request body exceeding the set size. Ideally the request against the proxied service should be dropped (if committed).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with RequestSizeGatewayFilterFactoryTest and run the setRequestSizeFilterWorksForStreams test to reproduce the failure without a Content-Length header. Trace the RequestSize filter implementation from that test and verify that oversized streamed bodies are rejected with PAYLOAD_TOO_LARGE before the full body reaches the proxied service.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.