Add support for X-Forwarded-Host in ServletUriComponentsBuilder [SPR-10110]

[spring-projects-issues]

Adarsh Ramamurthy opened SPR-10110 and commented

The problem with ServletUriComponentsBuilder is that it is poorly designed (uses only static method calls), eliminating the possibility to extend and enhance the behaviour.

One typical scenario that I discovered yesterday:

Our tomcat server is hosted behind Apache. The client (browser) accesses a URL using www.example.com/path/to/resource. However, because of the way Apache has been set up, it doesn't send along the Host header value of www.example.com to Tomcat. Instead, it sends the internal IP address. The original hostname of www.example.com is set in an X-Forwarded-Host header.

Now, because ServletUriComponentsBuilder uses request.getServerName() to construct the hostname part of the URL, any generated URLs will have the internal IP address instead of www.example.com.

The only way I can fix this currently is by either:

• Creating a HttpServletRequestWrapper that takes the value of X-Forwarded-Host header and sets it to Host header.

OR

• Rewriting ServletUriComponentsBuilder logic.

---

Reference URL: spring-projects/spring-hateoas#33

Issue Links:

• Regression in 4.1.5: UriComponentsBuilder.fromHttpRequest sets port to 80 i.s.o nothing/443 [SPR-12771] #17368 Regression in 4.1.5: UriComponentsBuilder.fromHttpRequest sets port to 80 i.s.o nothing/443
• Add support for x-forwarded- HttpServletRequest wrapping [SPR-13614] #18192 Add support for x-forwarded- HttpServletRequest wrapping
• SEC-2898 Use ServletUriComponentsBuilder.fromRequest for URL creation
• X-Forwarded-Host handling in ServletUriComponentsBuilder does not treat ports correctly [SPR-10718] #15346 X-Forwarded-Host handling in ServletUriComponentsBuilder does not treat ports correctly

Referenced from: commits 153508a

[spring-projects-issues]

Rossen Stoyanchev commented

We'll look into X-Forwarded-Host support in ServletUriComponentsBuilder. In the mean time you can do something like this:

ServletUriComponentsBuilder builder = ServletUriComponentsBuilder.fromCurrentRequestUri();

String host = ... ;
builder.host(host);

[spring-projects-issues]

Rossen Stoyanchev commented

Modified title (was: "ServletUriComponentsBuilder should be extensible")

[spring-projects-issues]

Rossen Stoyanchev commented

Link to temporary fix in spring-hateoas.