SECURITY.md

<providers>
    <provider>org.wso2.carbon.ndatasource.rdbms.RDBMSDataSourceReader</provider>
</providers>

<datasources>

    <datasource>
        <name>WSO2_CARBON_DB</name>
        <description>The datasource used for registry and user manager</description>
        <jndiConfig>
            <name>jdbc/WSO2CarbonDB</name>
        </jndiConfig>
        <definition type="RDBMS">
            <configuration>
                <url>jdbc:h2:repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE</url>
                <username>wso2carbon</username>
                <password>wso2carbon</password>
                <driverClassName>org.h2.Driver</driverClassName>
                <maxActive>50</maxActive>
                <maxWait>60000</maxWait>
                <testOnBorrow>true</testOnBorrow>
                <validationQuery>SELECT 1</validationQuery>
                <validationInterval>30000</validationInterval>
            </configuration>
        </definition>
    </datasource>

    <datasource>
        <name>WSO2AM_DB</name>
        <description>The datasource used for API Manager database</description>
        <jndiConfig>
            <name>jdbc/WSO2AM_DB</name>
        </jndiConfig>
        <definition type="RDBMS">
            <configuration>
                <url>jdbc:h2:repository/database/WSO2AM_DB;DB_CLOSE_ON_EXIT=FALSE</url>
                <username>wso2carbon</username>
                <password>wso2carbon</password>
                <driverClassName>org.h2.Driver</driverClassName>
                <maxActive>50</maxActive>
                <maxWait>60000</maxWait>
                <testOnBorrow>true</testOnBorrow>
                <validationQuery>SELECT 1</validationQuery>
                <validationInterval>30000</validationInterval>
            </configuration>
        </definition>
    </datasource>

     <datasource>
        <name>WSO2AM_STATS_DB</name>
        <description>The datasource used for getting statistics to API Manager</description>
        <jndiConfig>
            <name>jdbc/WSO2AM_STATS_DB</name>
        </jndiConfig>
        <definition type="RDBMS">
            <configuration>
                <url>jdbc:h2:<!-- Full path to JDBC database -->;AUTO_SERVER=TRUE</url>
                <username>wso2carbon</username>
                <password>wso2carbon</password>
                <driverClassName>org.h2.Driver</driverClassName>
                <maxActive>50</maxActive>
                <maxWait>60000</maxWait>
                <testOnBorrow>true</testOnBorrow>
                <validationQuery>SELECT 1</validationQuery>
                <validationInterval>30000</validationInterval>
            </configuration>
        </definition>
     </datasource>

    <datasource>
        <name>WSO2_MB_STORE_DB</name>
        <description>The datasource used for message broker database</description>
        <jndiConfig>
            <name>WSO2MBStoreDB</name>
        </jndiConfig>
        <definition type="RDBMS">
            <configuration>
                <url>jdbc:h2:repository/database/WSO2MB_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url>
                <username>wso2carbon</username>
                <password>wso2carbon</password>
                <driverClassName>org.h2.Driver</driverClassName>
                <maxActive>50</maxActive>
                <maxWait>60000</maxWait>
                <testOnBorrow>true</testOnBorrow>
                <validationQuery>SELECT 1</validationQuery>
                <validationInterval>30000</validationInterval>
                <defaultAutoCommit>false</defaultAutoCommit>
            </configuration>
        </definition>
    </datasource>
    <!-- For an explanation of the properties, see: http://people.apache.org/~fhanik/jdbc-pool/jdbc-pool.html -->
    <!--datasource>
        <name>SAMPLE_DATA_SOURCE</name>
        <jndiConfig>
            <name></name>
            <properties>
                <property name="java.naming.factory.initial"></property>
                <property name="java.naming.provider.url"></property>
            </properties>
        </jndiConfig>
        <definition type="RDBMS">
            <configuration>
                <defaultAutoCommit></defaultAutoCommit>
                <defaultReadOnly></defaultReadOnly>
                <defaultTransactionIsolation>NONE|READ_COMMITTED|READ_UNCOMMITTED|REPEATABLE_READ|SERIALIZABLE</defaultTransactionIsolation>
                <defaultCatalog></defaultCatalog>
                <username></username>
                <password svns:secretAlias="WSO2.DB.Password"></password>
                <maxActive></maxActive>
                <maxIdle></maxIdle>
                <initialSize></initialSize>
                <maxWait></maxWait>
                <dataSourceClassName>com.mysql.jdbc.jdbc2.optional.MysqlXADataSource</dataSourceClassName>
                <dataSourceProps>
                    <property name="url">jdbc:mysql://localhost:3306/Test1</property>
                    <property name="user">root</property>
                    <property name="password">123</property>
                </dataSourceProps>
            </configuration>
        </definition>
    </datasource-->

</datasources>

http://people.apache.org/~fhanik/jdbc-pool/jdbc-pool.htmlDescription:
API Gateway is not populating/appending x-forwarded/forwarded headers. Currently APIM simply forward those headers as is. Hence what back-end receives as the x-forwarded (say x-forwarded-host) information is, that of the client, not of the API gateway. We need to discuss this across team and come to conclusion about behavior. Logging this issue for recording purpose.

Suggested Labels:
apim,3.0.0

Suggested Assignees:

Affected Product Version:
2.2.0

OS, DB, other environments details and versions:

Steps to reproduce:

Related Issues:

Start with SECURITY.md and the reported API Gateway handling of x-forwarded and forwarded headers. Clarify the intended header behavior with the team, then document the agreed resolution and verify that the issue's stated client-versus-gateway information is addressed.