Skip to content

Process X-Forwarded-Ssl headers properly [SPR-16863] #21402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
spring-projects-issues opened this issue May 22, 2018 · 3 comments
Closed

Process X-Forwarded-Ssl headers properly [SPR-16863] #21402

spring-projects-issues opened this issue May 22, 2018 · 3 comments
Assignees
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Milestone

Comments

@spring-projects-issues
Copy link
Collaborator

spring-projects-issues commented May 22, 2018

Greg Turnquist opened SPR-16863 and commented

Spring HATEOAS has extra support built for handing X-Forwarded-Ssl headers, in the following code.

There is additionally a ForwardedHeader class used to parse Forwarded headers. It would be ideal if this header was handled by Spring MVC directly so Spring HATEOAS didn't have to bake in support as well. That would allow us to concentrate such functionality truly in one place.


Affects: 5.0.6

Reference URL: spring-projects/spring-hateoas#112

Issue Links:

Referenced from: commits c7c3e55, 3eac2dd

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented May 23, 2018

Rossen Stoyanchev commented

It's worth pointing out also that Spring HATEOAS needs to remove any remaining explicit checks, like for "X-Forwarded-Ssl", in order to align with #21209.

@spring-projects-issues
Copy link
Collaborator Author

Rossen Stoyanchev commented

So looking at the code in Spring HATEOAS, thee "X-Forwarded-Ssl" is checked and applied lazily in case neither "Forwarded" nor "X-Forwarded-Proto" have a protocol value. 

Rob Winch if that seems okay, I'll apply to UriComponentsBuilder#adaptedFromForwardedHeaders that in turn is used from ForwardedHeaderFilter.
 

@spring-projects-issues
Copy link
Collaborator Author

Greg Turnquist commented

I have a branch to apply such changes. Be advised, I have swept all such code into one location inside Spring HATEOAS such that is only used for Spring Framework 5.0 and ignored for Spring Framework 5.1. This code is also flagged as @Deprecated. Thus, whenever we rebase Spring HATEOAS against Spring 5.1, we can remove it for good.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

2 participants