No X-Forwarded-For (RemoteIP) header is written due to incompatibility between XForwardedHeadersFilter and ForwardedHeadersTransformer

[stefanocke]

Describe the bug
If ForwardedHeaderTransformer is enabled in Spring Cloud Gateway, X-Forwarded-For Header will not be sent to upstream services

Steps to reproduce

• Enable ForwardedHeaderTransformer in Spring Cloud Gateway by setting: server.forward-headers-strategy=framework
• Setup some upstream service to which the gateway fowards requests.
• Use a REST client to send some request to the upstream service via gateway. Set the X-Forwarded-For header in the request.
• Watch the request going to the upstream service. It has no X-Forwarded-For header.
• Other headers, like X-Forwarded-Host will work.

Debugging

Since a while, ForwardedHeaderTransformer in Spring Boot supports X-Forwarded-For header:

remoteAddress = UriComponentsBuilder.parseForwardedFor(request, remoteAddress);

In UriComponentsBuilder.parseForwardedFor, the address is build as following:

return InetSocketAddress.createUnresolved(host, port);

However, in Spring Cloud Gateway, we have the following in XForwardedHeadersFilter:

if (isForEnabled() && request.getRemoteAddress() != null
				&& request.getRemoteAddress().getAddress() != null) {
			String remoteAddr = request.getRemoteAddress().getAddress().getHostAddress();
			write(updated, X_FORWARDED_FOR_HEADER, remoteAddr, isForAppend());
		}

Debugging shows, that request.getRemoteAddress().getAddress() is null and so, no X-Fowarded-For Header is written.
I guess that is due to the InetSocketAddress.createUnresolved in UriComponentsBuilder.

I don't know whether ForwardedHeaderTransformer / UriComponentsBuilder or XForwardedHeadersFilter is wrong here, but together, they fail.

P.S.:
createUnresolved seems to be intentionally, to avoid DNS resolution. See spring-projects/spring-framework@c5ac8e8
So, it would probably be the best solution if XForwardedHeadersFilter could (also) deal with an unresolved remote address.

[justwiebe]

Is there any solution to this?

[hamish-spireon]

Is there a work around for this?

[blacklee123]

oh, gold, please I have this question too

[NadChel]

request.getRemoteAddress().getAddress() cannot be null in the current implementation since this line in XForwardedHeadersFilter

String remoteAddr = request.getRemoteAddress().getAddress().getHostAddress();

would throw an NPE. Since, as I understand, no DNS resolution is by design, we could replace that line with

InetAddress address = request.getRemoteAddress().getAddress();
String remoteAddr = (address == null) ? /* some default value; an empty string? */ : address.getHostAddress();

What that default value may be depends on whether there are any expectations of that value (e.g. if a specific format is expected, if it's in any way parsed at any place)

@spencergibb does this train of thought relate to you? If so, will an empty string do?

[MichalStehlikCz]

It might make sense to use same resolution like in ForwardedHeadersFilter

		String forValue;
		if (remoteAddress.isUnresolved()) {
			forValue = remoteAddress.getHostName();
		}
		else {
			InetAddress address = remoteAddress.getAddress();
			forValue = remoteAddress.getAddress().getHostAddress();

[dreamstar-enterprises]

Spring Webflux.

server:
  address: ${LOCALHOST}
  port: ${RESOURCE_SERVER_PORT}
  ssl:
    enabled: false
  forward-headers-strategy: native

framework caused removal of forwarded headers

But native was ignoring X-Forwarded-Prefix

So had to add this:

@Configuration
class WebConfig {

    @Bean
    fun forwardedHeaderTransformer(): ForwardedHeaderTransformer {
        val transformer = ForwardedHeaderTransformer()
        transformer.setRemoveOnly(false)
        return transformer
    }
}

@Component
internal class CustomWebFilter(
    private val transformer: ForwardedHeaderTransformer
): WebFilter {

    override fun filter(exchange: ServerWebExchange, chain: WebFilterChain): Mono<Void> {
        // Get the original request
        val originalRequest: ServerHttpRequest = exchange.request

        // Log original headers
        println("Original Headers: ${originalRequest.headers}")

        // Apply the ForwardedHeaderTransformer to the original request
        val transformedRequest: ServerHttpRequest = transformer.apply(originalRequest)

        // Log the transformed request path and headers
        println("Transformed Path: ${transformedRequest.path}")
        println("Transformed Headers: ${transformedRequest.headers}")

        // Mutate the exchange to use the transformed request
        val mutatedExchange = exchange.mutate()
            .request(transformedRequest)
            .build()

        // Proceed with the next filter in the chain
        return chain.filter(mutatedExchange)
    }
}

Request now does get transformed, but same problem, headers have disappeared

val remoteIp = exchange.request.remoteAddress?.address?.hostAddress
val xForwardedFor = exchange.request.headers.getFirst("X-Forwarded-For")
val XForwardedPrefix = exchange.request.headers.getFirst("X-Forwarded-Prefix")

rest-api-1 | X-Forwarded-For: null
rest-api-1 | X-Forwarded-Prefix: null
rest-api-1 | Remote IP: null

[MarpinLL]

I've found two ways to work around the issue:

First, you need to disable the forwarded headers in your Spring Cloud Gateway configuration:

spring:  
  cloud:
    gateway:
      forwarded:
        enabled: false

1. Send the X-Forwarded-* headers in the request: If you include headers like X-Forwarded-Host and X-Forwarded-Proto in the request, the routing will work correctly.

2. Add the headers directly in the route configuration: Alternatively, you can manually add these headers in the route configuration using AddRequestHeader, like this:

filters:
  - AddRequestHeader=X-Forwarded-Host, your-host:port
  - AddRequestHeader=X-Forwarded-Proto, http or https

Note that this works because I have a ForwardedHeaderFilter bean configured in my backend:

@Bean
ForwardedHeaderFilter forwardedHeaderFilter() {
    return new ForwardedHeaderFilter();
}

Both approaches should solve the issue when the forwarded.enabled setting is disabled.

Hope this helps.