Support for X-Forwarded-Prefix in Spring HATEOAS

Spring HATEOAS doesn’t currently support the X-Forwarded-Prefix header.

NOTE: Examples are illustrative

We are using a reverse proxy / API gateway to serve a HATEOAS webflux project. Our API gateway accepts requests at:

https://api.example.com/context/resource

Our backend service address for this is:

https://backend.example.com/resource

It returns the following HATEOAS links

{
  "_links": {
    "self": {
      "href": "https://backend.example.com/resource"
    }
  }
}

By using the following headers:

X-Forwarded-Host: api.example.com
X-Forwarded-Prefix: /context

We would expect the result to be

{
  "_links": {
    "self": {
      "href": "https://api.example.com/context/resource"
    }
  }
}

Instead we are seeing that the X-Forwarded-Host header is being applied correctly, but the X-Forwarded-Prefix header is not, e.g.:

{
  "_links": {
    "self": {
      "href": "https://api.example.com/resource"
    }
  }
}

The WebFluxLinkBuilder used to create HATEOAS links leverages the UrlComponentsBuilder from spring-web, which is missing the handling logic for the X-Forwarded-Prefix header. The ForwardedHeaderTransformer (also in spring-web) does handle this header.

I’m proposing having this added to the UrlComponentsBuilder.

[hughwphamill]

Was this ever addressed? @stuartwakefield ?

[rstoyanchev]

Can you elaborate? I don’t quite follow what is lost.

It is true that ForwardedHeaderTransformer removes all forwarded headers it applies, but that’s because they are now reflected in the contextPath and URI of the request, and their presence in the headers could lead to issues if any other code tries to process them again.