spring-cloud / spring-cloud/spring-cloud-gateway

Missing check if the response is committed in some response filters

Open
#3,905 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

waiting-for-triage
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Spring Boot 3.5.5
Spring Cloud 2025.0.0

All filters that modify the response should check whether the response has already been committed.
If the response has already been committed, for example due to the application of RateLimiter, an exception (java.lang.UnsupportedOperationException, when filters trying to modify the headers) and a 500 http status code, will be generated.

The issue has already been reported for RemoveResponseHeader (see #3718) and resolved by adding the missing check.

It looks like that the following filters, which alter the response headers, do not perform the above check:

  • SetResponseHeaderGateway
  • RewriteResponseHeader
  • DedupeResponseHeaderGateway

The list may be incomplete , but I have checked that the first two have the reported problem (please see my demo project https://github.com/LorenzoLuconi/spring-cloud-gateway-exception-exmple) and DedupeResponseHeaderGateway, looking at the source code, has the same problem.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with SetResponseHeaderGateway, RewriteResponseHeader, and DedupeResponseHeaderGateway, then compare their response handling with the resolved RemoveResponseHeader issue (#3718). Reproduce the failure using the linked demo project and verify that committed responses no longer cause header-modification exceptions or a 500 status.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.