spring-hateoas: x-forwarded-host & x-forwarded-prefix headers not working after project upgrade to Spring Boot 2.1

Okay, a little extra digging has uncovered:

1. Spring Boot doesn’t currently support all the X-Forwarded-* stuff through that property setting. The docs only list X-Forwarded-For and X-Forwarded-Proto supported by the existing property. Additionally, there are issues with each container regarding these de facto standard headers. Track Boot’s support at => https://github.com/spring-projects/spring-boot/issues/5677

2. That being said, to enable X-Forwarded-* support, add this to your application:

@Bean
ForwardedHeaderFilter forwardedHeaderFilter() {
    return new ForwardedHeaderFilter();
}

…and Spring Boot will pick up the filter bean and register it with your Spring MVC app. (I don’t have the WebFlux counterpart here).

1. Once you put in this bean, then you can do stuff like this:

curl -v localhost:8080/employees \
    -H 'X-Forwarded-Host: example.com' \
    -H 'X-Forwarded-Port: 9001'  \
    | jsonpp

…and see…

{
  "_embedded": {
    "employees": [
      {
        "id": 1,
        "name": "Bilbo Baggins",
        "role": "burglar",
        "_links": {
          "self": {
            "href": "http://example.com:9001/employees/1"
          },
          "employees": {
            "href": "http://example.com:9001/employees"
          }
        }
      },
      {
        "id": 2,
        "name": "Frodo Baggins",
        "role": "ring bearer",
        "_links": {
          "self": {
            "href": "http://example.com:9001/employees/2"
          },
          "employees": {
            "href": "http://example.com:9001/employees"
          }
        }
      }
    ]
  },
  "_links": {
    "self": {
      "href": "http://example.com:9001/employees"
    },
    "root": {
      "href": "http://example.com:9001"
    }
  }
}

Bottom line: this should be added to the reference docs so you don’t have to dig around in the issues or stackoverflow to get it going.

@patbaumgartner I have had the same problem. The solution was to use the ForwardedHeaderFilter. You have to register it with the @Bean annotation.

@Bean public Filter forwardedHeaderFilter() { return new ForwardedHeaderFilter(); }

https://docs.spring.io/spring/docs/5.1.3.RELEASE/spring-framework-reference/web.html#filters-forwarded-headers --> “There are security considerations…”

Unfortunately, I have the same issue with spring-data-rest. The x-forwarded-prefix was set in the request but spring-data-rest does not render it in the response.

Spring Boot 2.1.3 -> Spring Data Rest Starter

I need to add server.use-forward-headers=true and then only x-forwarded-host (host:port) is rendered in the hypermedia document. If I do not set the property the x-forwarded headers are ignored.

@GoldenToast well I’ll try it but that is what I thought the property I switched on above would do

To be precise, it’s Spring Framework 5.1 and Spring HATEOAS 0.25.1/1.0.0 that requires this shift.

Unless I have done something else wrong, it only half works, proto & port are fine, but host & prefix I can’t get to work

Sure I saw that so I used server.use-forward-headers=true to do it.