Redirects add port to Location header

[benediktwerner]

Description

When setting up any redirect, e.g. following the initial example at https://gateway.envoyproxy.io/v1.0.1/tasks/traffic/http-redirect/ (though removing the backendRefs which aren't actually allowed together with a redirect), Envoy Gateway will add an explicit port (in this case 443) to the location header:

$ curl -L -v --header "Host: redirect.example" "http://localhost:8888/get"
...
< HTTP/1.1 301 Moved Permanently
< location: https://www.example.com:443/get

(The example curl output in the docs actually doesn't show the port but that's not the behavior I observe.)

This is counter to the recommendation given by the Gateway API which on the ports field of the redirect filter (https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRequestRedirectFilter) states:

Implementations SHOULD NOT add the port number in the ‘Location’ header in the following cases:

• A Location header that will use HTTP (whether that is determined via the Listener protocol or the Scheme field) and use port 80.
• A Location header that will use HTTPS (whether that is determined via the Listener protocol or the Scheme field) and use port 443.

This happens even if the port field isn't actually set in the redirect and even if it's only a path redirect, with no change to the hostname, scheme, or port.

Using egctl, it looks like the following Envoy configuration is generated for the route for the example from the docs:

              redirect:
                portRedirect: 443
                schemeRedirect: https

Presumably, the portRedirect shouldn't be set in this case.

This probably doesn't matter in most cases since browsers apparently silently remove the port when following the redirect but some http clients don't which for us then lead to an issue in combination with OIDC because the URL with the port wasn't registered as a valid callback URL.

Environment

• Envoy Gateway v1.0.1
• Envoy v1.29.3

[arkodg]

digging into this, looks like the change was made #1601 to make upstream conformance tests pass kubernetes-sigs/gateway-api#1880
@shawnh2 is there a way to make sure the conformance tests pass and we dont append the port in the Location header

[shawnh2]

Thanks @benediktwerner for spotting this!

The implementation of upstream GW-API redirPort were missing in EG:

Implementations SHOULD NOT add the port number in the ‘Location’ header in the following cases:

A Location header that will use HTTP (whether that is determined via the Listener protocol or the Scheme field) and use port 80.
A Location header that will use HTTPS (whether that is determined via the Listener protocol or the Scheme field) and use port 443.

Yes @arkodg, can be fixed in the xds translator:

gateway/internal/xds/translator/route.go

Line 348 in 9e2cfb4

if redirection.Port != nil {

By adding extra checks, update redirPort only if it is not 80 nor 443.

I've done the test, the well-known port number is not shown in ‘Location’ header anymore.