x-forwarded-host & x-forwarded-prefix headers not working after project upgrade to Spring Boot 2.1

[RobMaskell]

Had a working project, Spring boot / Spring data rest / Spring Hateos and after upgrade to Spring boot 2.1.3 it appears that x-forwarded-prefix and x-forwarded-host are not longer working. x-forwarded-proto and x-forwarded-port are working fine.

Broke it out into the simplest possible app demo.tar.gz to check and still couldn't get it working.

If I run

http -v GET localhost:8081

the result is

GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: localhost:8081
User-Agent: HTTPie/0.9.8



HTTP/1.1 200 
Content-Type: application/hal+json;charset=UTF-8
Date: Sat, 09 Mar 2019 18:21:59 GMT
Transfer-Encoding: chunked

{
    "_links": {
        "people": {
            "href": "http://localhost:8081/people{?page,size,sort}",
            "templated": true
        },
        "profile": {
            "href": "http://localhost:8081/profile"
        }
    }
}

all ok so far, however when I try

http -v GET localhost:8081 x-forwarded-proto:https x-forwarded-host:example.com:9090 x-forwarded-port:9090 x-forwarded-prefix:/api

I get

GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: localhost:8081
User-Agent: HTTPie/0.9.8
x-forwarded-host: example.com:9090
x-forwarded-port: 9090
x-forwarded-prefix: /api
x-forwarded-proto: https



HTTP/1.1 200 
Content-Type: application/hal+json;charset=UTF-8
Date: Sat, 09 Mar 2019 18:23:01 GMT
Transfer-Encoding: chunked

{
    "_links": {
        "people": {
            "href": "https://localhost:9090/people{?page,size,sort}",
            "templated": true
        },
        "profile": {
            "href": "https://localhost:9090/profile"
        }
    }
}

I was expecting the links to be of the form https://example.com:9090/api/profile

[gregturn]

Duplicates #753.

[RobMaskell]

But I'm testing with 0.25.1 which fixes 753?

[gregturn]

Yup

d885cb0 is the fix backported to 0.25.x and released in 0.25.1.release.

[RobMaskell]

@gregturn I'm obviously being stoopid here, but if I'm using the fixed code, and x-forwarded-proto is working fine so I am using the fixed code, why am I still seeing issues with x-forwarded-host and x-forwarded-prefix?

[gregturn]

Spring Boot now disables forwarded header handler by default. You have to enable it.

[RobMaskell]

Sure I saw that so I used server.use-forward-headers=true to do it.

[gregturn]

And it still doesn’t work?

[RobMaskell]

Unless I have done something else wrong, it only half works, proto & port are fine, but host & prefix I can't get to work

[gregturn]

Don’t think you can include a port number with x-forwarded-host.

[RobMaskell]

Yh I wondered about that but I think I just copied what I was getting from Spring Cloud Gateway (I'll have a look at that tomorrow and maybe raise something against that project) but with or without the port appended host doesn't work for me

[RobMaskell]

And what I did have was working with Spring Boot 2.0, and associated version of Spring Cloud

[gregturn]

To be precise, it's Spring Framework 5.1 and Spring HATEOAS 0.25.1/1.0.0 that requires this shift.

[RobMaskell]

Yes and I my upgrade from Spring Boot 2.0.x to 2.1.3 has picked up Spring Framework 5.1 and Spring HATEOAS 0.25.1 which is when I noticed this issue.

I tried looking at the code and I wonder if it's the use of URIComponentsBuilder rather that the Servlet version that might be the issue as the former seems to still be accessing x-forwarded-* headers directly where the later explicitly mentions the forwarded headers centralisation in 5.1. But I'm no where near sure, just an idea.