-
Bug
-
Resolution: Done
-
Major
-
1.3.23.Final, 1.4.0.CR2
-
None
-
None
The effect of a request's X-Forwarded-* headers appears to be inconsistent when sending a redirect. Here's a small server that should illustrate the problem:
package com.example; import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import io.undertow.Handlers; import io.undertow.Undertow; import io.undertow.servlet.Servlets; import io.undertow.servlet.api.DeploymentInfo; import io.undertow.servlet.api.DeploymentManager; public class RedirectServer { public static void main(String[] args) throws ServletException { DeploymentInfo servletBuilder = Servlets.deployment() .setClassLoader(RedirectServer.class.getClassLoader()) .setContextPath("/myapp") .setDeploymentName("test.war") .addServlets( Servlets.servlet("redirect", RedirectServlet.class).addMapping("/*")); DeploymentManager manager = Servlets.defaultContainer().addDeployment(servletBuilder); manager.deploy(); Undertow server = Undertow.builder() .addHttpListener(8080, "localhost") .setHandler(Handlers.path(Handlers.proxyPeerAddress(manager.start()))) .build(); server.start(); } @SuppressWarnings("serial") static class RedirectServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { resp.sendRedirect("/redirected"); } } }
Making a request to /myapp/redirect with X-Forwarded-* headers results in a 302 response as expected but the Location header is not as expected:
curl -v 127.0.0.1:8080/myapp/redirect -H 'X-Forwarded-Proto: https' -H 'X-Forwarded-Host: api.example.com' -H 'X-Forwarded-Port: 443' * Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0) > GET /myapp/redirect HTTP/1.1 > Host: 127.0.0.1:8080 > User-Agent: curl/7.46.0 > Accept: */* > X-Forwarded-Proto: https > X-Forwarded-Host: api.example.com > X-Forwarded-Port: 443 > < HTTP/1.1 302 Found < Connection: keep-alive < Location: https://127.0.0.1:8080/redirected < Content-Length: 0 < Date: Thu, 30 Jun 2016 10:04:42 GMT < * Connection #0 to host 127.0.0.1 left intact
Given this request, I would expect the Location header to be https://api.example.com/redirected but it's https://127.0.0.1:8080. The scheme is as expected (X-Forwarded-Proto has been honoured) but the host and port are not (X-Forwarded-Host and X-Forwarded-Port have been ignored).
FWIW, Jetty 9.3 produces a Location header based on all three X-Forwarded-* headers.
- causes
-
JBEAP-5669 [GSS](7.0.z) proxy-address-forwarding has not effect when Host header is present
- Verified
-
JBEAP-6130 [GSS](7.1.0) proxy-address-forwarding has not effect when Host header is present
- Closed
- is related to
-
UNDERTOW-990 Redirect Location header ignores X-Forwarded-Prefix
- Resolved