{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/contrib/issues/2312","repository_url":"https://api.github.com/repos/kubernetes/contrib","labels_url":"https://api.github.com/repos/kubernetes/contrib/issues/2312/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/contrib/issues/2312/comments","events_url":"https://api.github.com/repos/kubernetes/contrib/issues/2312/events","html_url":"https://github.com/kubernetes/contrib/issues/2312","id":201253210,"number":2312,"title":"Ingress overwrites instead of adds X-Forwarded-* headers","user":{"login":"ractive","id":783861,"avatar_url":"https://avatars3.githubusercontent.com/u/783861?v=4","gravatar_id":"","url":"https://api.github.com/users/ractive","html_url":"https://github.com/ractive","followers_url":"https://api.github.com/users/ractive/followers","following_url":"https://api.github.com/users/ractive/following{/other_user}","gists_url":"https://api.github.com/users/ractive/gists{/gist_id}","starred_url":"https://api.github.com/users/ractive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ractive/subscriptions","organizations_url":"https://api.github.com/users/ractive/orgs","repos_url":"https://api.github.com/users/ractive/repos","events_url":"https://api.github.com/users/ractive/events{/privacy}","received_events_url":"https://api.github.com/users/ractive/received_events","type":"User","site_admin":false},"labels":[{"id":778141653,"url":"https://api.github.com/repos/kubernetes/contrib/labels/lifecycle/rotten","name":"lifecycle/rotten","color":"604460","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-01-17T11:33:06Z","updated_at":"2018-03-21T20:41:24Z","closed_at":null,"author_association":"NONE","body":"The ingress proxy sets the X-Forwarded-* headers and hereby overwrites previous values set by other proxies. So the application only sees the X-Forwarded-* header values set by the ingress, but not by the first proxy and can therefore not create URLs pointing to itself. The ingress proxy should either add these headers (using `add_header`) or add its value in a comma separated list to an existing header value. Unfortunately there's no standard describing these X-Forwarded headers, but it seems as if both variants (multiple headers and comma separated values) are seen in the wild.\r\nThe changes would be probably needed to be done here: https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/nginx.tmpl#L276\r\n\r\nWe concretely face this issue because we terminate all https connections on an external loadbalancer (e.g. https://api.example.com) that then routes the traffic via http to an ingress endpoint (e.g. http://internal.example.com). The redirect URI that is created by the internal app is now https://api.example.com:80 - which is wrong. This is because the ingress sets the X-Forwarded-Port header to 80. The X-Forwarded-Port value 443 which is set by the loadbalancer (where ssl is terminated) should be preserved.\r\n\r\nThis issue shows up in a Spring Boot application with OAuth2 protected resources, where the  app creates the redirect_uri pointing to itself sent to the OAuth provider using a UriComponentsBuilder [1] in the OAuth2ClientContextFilter [2]. The UriComponentsBuilder builds the URL using the X-Forwarded-* headers, picking the first header and the first value (if comma spearated).\r\n\r\n[1] https://github.com/spring-projects/spring-framework/blob/master/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java#L705\r\n\r\n[2] https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientContextFilter.java#L122\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/contrib/issues/comments/375088375","html_url":"https://github.com/kubernetes/contrib/issues/2312#issuecomment-375088375","issue_url":"https://api.github.com/repos/kubernetes/contrib/issues/2312","id":375088375,"user":{"login":"SEJeff","id":4603,"avatar_url":"https://avatars1.githubusercontent.com/u/4603?v=4","gravatar_id":"","url":"https://api.github.com/users/SEJeff","html_url":"https://github.com/SEJeff","followers_url":"https://api.github.com/users/SEJeff/followers","following_url":"https://api.github.com/users/SEJeff/following{/other_user}","gists_url":"https://api.github.com/users/SEJeff/gists{/gist_id}","starred_url":"https://api.github.com/users/SEJeff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SEJeff/subscriptions","organizations_url":"https://api.github.com/users/SEJeff/orgs","repos_url":"https://api.github.com/users/SEJeff/repos","events_url":"https://api.github.com/users/SEJeff/events{/privacy}","received_events_url":"https://api.github.com/users/SEJeff/received_events","type":"User","site_admin":false},"created_at":"2018-03-21T20:41:23Z","updated_at":"2018-03-21T20:41:23Z","author_association":"NONE","body":"@ractive does your external load balancer support the [PROXY protocol](https://www.haproxy.com/blog/haproxy/proxy-protocol/)? haproxy, nginx, amazon, and google's load balancers all support it. It will mitigate this problem for you entirely (and is generally a better / protocol agnostic way of preserving source ip)."}}
{"actor":{"display_login":"SEJeff"}}