[
https://issues.apache.org/jira/browse/KNOX-897?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15892901#comment-15892901
]
Attila Kanto edited comment on KNOX-897 at 3/2/17 8:16 PM:
-----------------------------------------------------------
Hi [~moresandeep],
Yes, I am using a Load Balancer / reverse proxy between client and Knox. The
X-Forwarded-* headers are just de facto standard headers and there are no
strict rules whether all of them needs to be filled out, some proxies are just
using the the X-Forwarded-Host header and specifying the host name and also the
port. e.g.:
{code}
X-Forwarded-Host: someething.example.com:8080
{code}
or in the case when the default 80 or 443 port is used then:
{code}
X-Forwarded-Host: my-load-balancer.example.com
{code}
Even the original issue it is stated the same
https://issues.apache.org/jira/browse/KNOX-476:
{code}
X-Forwarded-Port
Examples:
X-Forwarded-Port: 8443
The need for this is less clear. The X-Forwarded-Host clearly does seem to
contain the port information for non-default ports (i.e. 80 or 443). So this
may not be required.
{code}
So in the first case when the LB / reverse proxy has a non standard port then
Knox correctly determines the port from X-Forwarded-Host header field in
UrlRewriteResponse.java class:
{code}
int separator = xForwardedHostname.indexOf( ":" );
311 if ( separator > 0 ) {
312 //a specific port in the forwarded host wins
313 xForwardedPort = xForwardedHostname.substring(separator + 1,
xForwardedHostname.length());
{code}
The problem occurs when the LB / reverse proxy uses the standard 80 or 443
port, and in that case Knox uses its own port 8443 instead of standard 80 or
443 ports and all of the links will be broken as you can see on the screenshot
attached to this jira, since the LB listens on default 443 port and not on the
8443.
Attila
was (Author: akanto):
Hi @Sandeep More,
Yes, I am using a Load Balancer / reverse proxy between client and Knox. The
X-Forwarded-* headers are just de facto standard headers and there are no
strict rules whether all of them needs to be filled out, some proxies are just
using the the X-Forwarded-Host header and specifying the host name and also the
port. e.g.:
{code}
X-Forwarded-Host: someething.example.com:8080
{code}
or in the case when the default 80 or 443 port is used then:
{code}
X-Forwarded-Host: my-load-balancer.example.com
{code}
Even the original issue it is stated the same
https://issues.apache.org/jira/browse/KNOX-476:
{code}
X-Forwarded-Port
Examples:
X-Forwarded-Port: 8443
The need for this is less clear. The X-Forwarded-Host clearly does seem to
contain the port information for non-default ports (i.e. 80 or 443). So this
may not be required.
{code}
So in the first case when the LB / reverse proxy has a non standard port then
Knox correctly determines the port from X-Forwarded-Host header field in
UrlRewriteResponse.java class:
{code}
int separator = xForwardedHostname.indexOf( ":" );
311 if ( separator > 0 ) {
312 //a specific port in the forwarded host wins
313 xForwardedPort = xForwardedHostname.substring(separator + 1,
xForwardedHostname.length());
{code}
The problem occurs when the LB / reverse proxy uses the standard 80 or 443
port, and in that case Knox uses its own port 8443 instead of standard 80 or
443 ports and all of the links will be broken as you can see on the screenshot
attached to this jira, since the LB listens on default 443 port and not on the
8443.
Attila
> X-Forwarded-Port is incorrectly determined
> ------------------------------------------
>
> Key: KNOX-897
> URL: https://issues.apache.org/jira/browse/KNOX-897
> Project: Apache Knox
> Issue Type: Bug
> Affects Versions: 0.11.0
> Reporter: Attila Kanto
> Attachments: gateway.log, knox-897.patch, Screen Shot 2017-03-01 at
> 14.44.03.png
>
>
> If the client fills out the following headers:
> {code}
> Header[X-Forwarded-Host]=local.somehost.com
> Header[X-Forwarded-Proto]=https
> {code}
> And does not specify the port number in X-Forwarded-Host since it uses the
> the default port, then Knox automatically populates X-Forwarded-Port header
> field with its own local port e.g. 8443 instead of the default 443 which
> results in page not founds (see screenshot and log).
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
