Update RemoteAddrRoutePredicateFactory to optionally respect the X-Forwarded-For header. Addresses #155.
#156
Conversation
Codecov Report
@@ Coverage Diff @@
## master #156 +/- ##
========================================
+ Coverage 70.9% 72% +1.09%
========================================
Files 99 87 -12
Lines 2437 1879 -558
Branches 166 123 -43
========================================
- Hits 1728 1353 -375
+ Misses 617 460 -157
+ Partials 92 66 -26
Continue to review full report at Codecov.
|
fitzoh
force-pushed
the
master
branch
2 times, most recently
from
16d8500 to
bb1c346
Compare
|
Need to look into security implications as well, this is probably a good starting point cloudfoundry/gorouter#179 |
|
I don't know how to do it with tuple. Seems like it's all or nothing. Maybe |
|
I'll start digging back into this one, should probably add a link to #125 as well. |
fitzoh
force-pushed
the
master
branch
3 times, most recently
from
5a11f8d to
14b1e21
Compare
|
Did some rebasing to catch up with the transition from String IPs -> InetSocketAddress and made it easier to customize the way the client IP is discovered. By default, the existing behavior of For instance, if you're running with just NGINX in front of the gateway, the If you're running in Cloud Foundry with behind HAPROXY, then the gorouter, the The index is 1 based to prevent a user accidentally introducing an off by 1 error and erring too far in the untrusted direction. Future work might include a remoteAddressResolver which takes a list of trusted IP addresses and terminates at the first untrusted IP. This would provide more flexibility if the number of ingress hops is unknown, but less helpful if trusted ip's are unknown. Regarding |
|
|
||
| /** | ||
| * @author Spencer Gibb | ||
| * @author Andrew Fitzgerald | ||
| */ | ||
| public class RoutePredicateFactoryUtils { |
There was a problem hiding this comment.
I don't think this is the right place for this. After looking at the class, I'm going to remove it and move the one static method to the single class where it is used.
There was a problem hiding this comment.
Maybe a class called RemoteAddressResolver.
| * @param maxTrustedIndex correlates to the number of trusted proxies expected in front spring cloud gateway | ||
| * (index starts at 1). | ||
| */ | ||
| public static InetSocketAddress extractRemoteAddressFromXForwardedHeaderByMaxTrustedIndex(ServerWebExchange exchange, int maxTrustedIndex) { |
There was a problem hiding this comment.
These could possible attached to an enum and therefore used in normal configuration of RemoteAddrRoutePredicateFactory
…-Forwarded-For` header. Fixes spring-cloudgh-155.
…d for extracting client IP with is safer from spoofing of X-Forwarded-For header.
|
Rebased and moved things out of There's now an The Might need another round of polish, but wanted to check in after that rebase+refactor. |
…-Forwarded-For` header. Addresses spring-cloud#155. (spring-cloud#156) * Update `RemoteAddrRoutePredicateFactory` to optionally respect the `X-Forwarded-For` header. Fixes spring-cloudgh-155. * Make function to extract client IP configurable. Add additional method for extracting client IP with is safer from spoofing of X-Forwarded-For header.
Doesn't play nice with yaml config yet, haven't figured out how to parse additional arguments from
Tupleyet.