x-forwarded-proto broken in Spring Boot 2.1.1
See original GitHub issueFor the following test:
@Test
fun `GET links uses proto headers`() {
mvc.perform(get("/v1/").header("x-forwarded-proto", "https"))
.andExpect(status().isOk)
.andExpect(jsonPath("$._links.activate.href", startsWith("https")))
}
And the following implementation:
private fun buildLinkForUser(currentUser: User) =
entityLinks.linkToCollectionResource(UserResource::class.java).withRel("activate")
Or alternatively with controller links, e.g.:
fun buildLinkForUser(): Link = linkTo(methodOn(UserController::class.java).activate())
.withRel("activate")
I get the test passing in Spring Boot 2.0.7 and failing in Spring Boot 2.1.1 - because the link gets http
instead of https
.
I checked Spring Hateoas in both boot releases and it remains 0.25.0. Obviously, this makes me think this issue doesn’t belong here. However, I was hoping you could help me reassign it where it belongs?
Issue Analytics
- State:
- Created 5 years ago
- Comments:34 (13 by maintainers)
Top Results From Across the Web
How to cope with x-forwarded-headers in Spring Boot 2.2.0 ...
0 application with Spring Web MVC is running behind a reverse proxy. How can Spring cope properly with X-Forwarded-{Prefix,Host,Proto} -headers ...
Read more >“How-to” Guides - Spring
2.1.1. Automatic Property Expansion Using Maven. You can automatically expand properties from the Maven project by using resource filtering.
Read more >Spring Boot Reference Guide
This section provides a brief overview of Spring Boot reference documentation. Think of it as map for the rest of the document. You...
Read more >Spring Boot Reference Guide
This section provides a brief overview of Spring Boot reference documentation. Think of it as map for the rest of the document. You...
Read more >Web on Reactive Stack - Spring
Spring Boot has a WebFlux starter that automates these steps. ... X-Forwarded-Proto , X-Forwarded-Ssl , and X-Forwarded-Prefix .
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
For future readers,
use-forward-headers
has been deprecated in favour offorward-headers-strategy
:forward-headers-strategy
defaults tonone
.Spring Framework now defaults with Forwarded header support disabled. So you have to use that setting for any apps you need from here on.
I’ll consult with @odrotbohm about seeing if we can get a patch release out the door.