ControllerLinkBuilder does not handle multiple X-Forwarded-* headers values

[smilasek]

Hi,

Spring Cloud has released Camden.SR2 this week. It includes following bug fix from Spring Cloud Netflix project: spring-cloud/spring-cloud-netflix#959.
particular commit: spring-cloud/spring-cloud-netflix@a38b7b7

Based on that X-Forwarded-Host, X-Forwarded-Port and X-Forwarded-Proto could have multiple values separated by comma.

X-Forwarded-Host is already handled properly by ControllerLinkBuilder (

spring-hateoas/src/main/java/org/springframework/hateoas/mvc/ControllerLinkBuilder.java

Lines 236 to 256 in 642b673

	String host = forwarded.getHost();
	host = hasText(host) ? host : request.getHeader("X-Forwarded-Host");
	if (!hasText(host)) {
	return builder;
	}
	String[] hosts = commaDelimitedListToStringArray(host);
	String hostToUse = hosts[0];
	if (hostToUse.contains(":")) {
	String[] hostAndPort = split(hostToUse, ":");
	builder.host(hostAndPort[0]);
	builder.port(Integer.parseInt(hostAndPort[1]));
	} else {
	builder.host(hostToUse);
	builder.port(-1); // reset port if it was forwarded from default port
	}

).

X-Forwarded-Port and X-Forwarded-Proto are not.

Additionally for multiple values of X-Forwarded-Port header application is throwing NumberFormatExceptionbecause of input values like 8080,443 etc.

[otrosien]

@dsyer could you point to the RFC specifying the X-Forwarded-Port behaviour you implemented in spring-cloud/spring-cloud-netflix@a38b7b7 ?

[otrosien]

... found it, it's probably https://tools.ietf.org/html/rfc7239#section-4 -- but in this RFC only "by", "for", "host" and "proto" are defined. The spec allows extensions (#section-5.5), but basically, with regards to "port" it means, that it is implementation-specific. On the other hand, UriComponentsBuilder from spring-framework deals with comma-separated ports, since 4.2.0.RELEASE:
https://github.com/spring-projects/spring-framework/blob/1f6f0dc101fb425bd63786ef669b0626a6591543/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java#L674 / spring-projects/spring-framework@88a1448#diff-73d13991926d9c9b00031a62c7e39c95

[dsyer]

There's no RFC for X-Forwarded-Port as far as I know. But it seems to be a common enough convention in proxies that we support it in Spring (https://github.com/spring-projects/spring-framework/blob/1f6f0dc101fb425bd63786ef669b0626a6591543/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java#L674).

[otrosien]

The ControllerLinkBuilder should just delegate this logic to UriComponentsBuilder, which as stated above, is already capable of correctly dealing with the X-Forwarded headers.

[odrotbohm]

Wouldn't mind to see a PR, @otrosien!

[odrotbohm]

Thanks to @otrosien, that should be in place now.