ServletUriComponentsBuilder should replace context path when X-Forwarded-Prefix is present [SPR-16650]

[spring-projects-issues]

Antonio Petrelli opened SPR-16650 and commented

ServletUriComponentsBuilder.fromContextPath, if the X-Forwarded-Prefix header is present, prepends the header value to the context path.
It should, instead, replace it, since this is what ForwardedHeaderFilter does.

In my case I see URLs in Spring Data Rest results are affected.

Workaround: use ForwardedHeaderFilter instead of relying on ServletUriComponentsBuilder.

---

Affects: 4.3.14

Issue Links:

• Support for X-Forwarded-Prefix in ServletUriComponentsBuilder [SPR-12500] #17105 Support for X-Forwarded-Prefix in ServletUriComponentsBuilder
• ForwardedHeaderFilter could support X-Forwarded-Prefix as well [SPR-14270] #18842 ForwardedHeaderFilter could support X-Forwarded-Prefix as well
• UriComponentsBuilder Forwarded header parsing can throw java.lang.NumberFormatException [SPR-16660] #21201 UriComponentsBuilder Forwarded header parsing can throw java.lang.NumberFormatException

Referenced from: commits 986d219, 240d6f5

Backported to: 4.3.15

[spring-projects-issues]

Rossen Stoyanchev commented

X-Forwarded-Prefix support was added with #17105 in 4.1.3 and has always worked by prepending. The ForwardedHeaderFilter was added later in 4.3 but the conclusion there was to replace the contextPath.

We'll also need to change fromRequest(request) and fromRequestUri(request) to replace the contextPath portion of request.getRequestURI() rather than simply prepending.