5. GatewayFilter Factories
Prev |  | Next

# 5. GatewayFilter Factories

Route filters allow the modification of the incoming HTTP request or outgoing HTTP response in some manner. Route filters are scoped to a particular route. Spring Cloud Gateway includes many built-in GatewayFilter Factories.

## 5.1 AddRequestHeader GatewayFilter Factory

The AddRequestHeader GatewayFilter Factory takes a name and value parameter.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: add_request_header_route
            uri: http://example.org
            filters:
            - AddRequestHeader=X-Request-Foo, Bar

This will add `X-Request-Foo:Bar` header to the downstream request’s headers for all matching requests.

## 5.2 AddRequestParameter GatewayFilter Factory

The AddRequestParameter GatewayFilter Factory takes a name and value parameter.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: add_request_parameter_route
            uri: http://example.org
            filters:
            - AddRequestParameter=foo, bar

This will add `foo=bar` to the downstream request’s query string for all matching requests.

## 5.3 AddResponseHeader GatewayFilter Factory

The AddResponseHeader GatewayFilter Factory takes a name and value parameter.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: add_request_header_route
            uri: http://example.org
            filters:
            - AddResponseHeader=X-Response-Foo, Bar

This will add `X-Response-Foo:Bar` header to the downstream response’s headers for all matching requests.

## 5.4 Hystrix GatewayFilter Factory

The Hystrix GatewayFilter Factory takes a single `name` parameters, which is the name of the `HystrixCommand`. (More options might be added in future releases).

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: hytstrix_route
            uri: http://example.org
            filters:
            - Hystrix=myCommandName

This wraps the remaining filters in a `HystrixCommand` with command name `myCommandName`.

## 5.5 PrefixPath GatewayFilter Factory

The PrefixPath GatewayFilter Factory takes a single `prefix` parameter.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: prefixpath_route
            uri: http://example.org
            filters:
            - PrefixPath=/mypath

This will prefix `/mypath` to the path of all matching requests. So a request to `/hello`, would be sent to `/mypath/hello`.

## 5.6 RequestRateLimiter GatewayFilter Factory

The RequestRateLimiter GatewayFilter Factory takes three parameters: `replenishRate`, `burstCapacity` & `keyResolverName`.

`replenishRate` is how many requests per second do you want a user to be allowed to do.

`burstCapacity` TODO: document burst capacity

`keyResolver` is a bean that implements the `KeyResolver` interface. In configuration, reference the bean by name using SpEL. `#{@myKeyResolver}` is a SpEL expression referencing a bean with the name `myKeyResolver`.

KeyResolver.java.

    public interface KeyResolver {
    	Mono<String> resolve(ServerWebExchange exchange);
    }

The `KeyResolver` interface allows pluggable strategies to derive the key for limiting requests. In future milestones, there will be some `KeyResolver` implementations.

The redis implementation is based off of work done at Stripe. It requires the use of the `spring-boot-starter-data-redis-reactive` Spring Boot starter.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: requestratelimiter_route
            uri: http://example.org
            filters:
            - RequestRateLimiter=10, 20, #{@userKeyResolver}

Config.java.

    @Bean
    KeyResolver userKeyResolver() {
        return exchange -> Mono.just(exchange.getRequest().getQueryParams().getFirst("user"));
    }

This defines a request rate limit of 10 per user. The `KeyResolver` is a simple one that gets the `user` request parameter (note: this is not recommended for production).

## 5.7 RedirectTo GatewayFilter Factory

The RedirectTo GatewayFilter Factory takes a `status` and a `url` parameter. The status should be a 300 series redirect http code, such as 301. The url should be a valid url. This will be the value of the `Location` header.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: prefixpath_route
            uri: http://example.org
            filters:
            - RedirectTo=302, http://acme.org

This will send a status 302 with a `Location:http://acme.org` header to perform a redirect.

## 5.8 RemoveNonProxyHeaders GatewayFilter Factory

The RemoveNonProxyHeaders GatewayFilter Factory removes headers from forwarded requests. The default list of headers that is removed comes from the IETF.

The default removed headers are:

- Connection
- Keep-Alive
- Proxy-Authenticate
- Proxy-Authorization
- TE
- Trailer
- Transfer-Encoding
- Upgrade

To change this, set the `spring.cloud.gateway.filter.remove-non-proxy-headers.headers` property to the list of header names to remove.

## 5.9 RemoveRequestHeader GatewayFilter Factory

The RemoveRequestHeader GatewayFilter Factory takes a `name` parameter. It is the name of the header to be removed.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: removerequestheader_route
            uri: http://example.org
            filters:
            - RemoveRequestHeader=X-Request-Foo

This will remove the `X-Request-Foo` header before it is sent downstream.

## 5.10 RemoveResponseHeader GatewayFilter Factory

The RemoveResponseHeader GatewayFilter Factory takes a `name` parameter. It is the name of the header to be removed.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: removeresponseheader_route
            uri: http://example.org
            filters:
            - RemoveResponseHeader=X-Response-Foo

This will remove the `X-Response-Foo` header from the response before it is returned to the gateway client.

## 5.11 RewritePath GatewayFilter Factory

The RewritePath GatewayFilter Factory takes a path `regexp` parameter and a `replacement` parameter. This uses Java regular expressions for a flexible way to rewrite the request path.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: rewritepath_route
            uri: http://example.org
            predicates:
            - Path=/foo/**
            filters:
            - RewritePath=/foo/(?<segment>.*), /$\{segment}

For a request path of `/foo/bar`, this will set the path to `/bar` before making the downstream request. Notice the `$\` which is replaced with `$` because of the YAML spec.

## 5.12 SecureHeaders GatewayFilter Factory

The SecureHeaders GatewayFilter Factory adds a number of headers to the response at the reccomendation from this blog post.

The following headers are added (allong with default values):

- `X-Xss-Protection:1; mode=block`
- `Strict-Transport-Security:max-age=631138519`
- `X-Frame-Options:DENY`
- `X-Content-Type-Options:nosniff`
- `Referrer-Policy:no-referrer`
- `Content-Security-Policy:default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline'`
- `X-Download-Options:noopen`
- `X-Permitted-Cross-Domain-Policies:none`

To change the default values set the appropriate property in the `spring.cloud.gateway.filter.secure-headers` namespace:

Property to change:

- `xss-protection-header`
- `strict-transport-security`
- `frame-options`
- `content-type-options`
- `referrer-policy`
- `content-security-policy`
- `download-options`
- `permitted-cross-domain-policies`

## 5.13 SetPath GatewayFilter Factory

The SetPath GatewayFilter Factory takes a path `template` parameter. It offers a simple way to manipulate the request path by allowing templated segments of the path. This uses the uri templates from Spring Framework. Multiple matching segments are allowed.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: setpath_route
            uri: http://example.org
            predicates:
            - Path=/foo/{segment}
            filters:
            - SetPath=/{segment}

For a request path of `/foo/bar`, this will set the path to `/bar` before making the downstream request.

## 5.14 SetResponseHeader GatewayFilter Factory

The SetResponseHeader GatewayFilter Factory takes `name` and `value` parameters.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: setresponseheader_route
            uri: http://example.org
            filters:
            - SetResponseHeader=X-Response-Foo, Bar

This GatewayFilter replaces all headers with the given name, rather than adding. So if the downstream server responded with a `X-Response-Foo:1234`, this would be replaced with `X-Response-Foo:Bar`, which is what the gateway client would receive.

## 5.15 SetStatus GatewayFilter Factory

The SetStatus GatewayFilter Factory takes a single `status` parameter. It must be a valid Spring `HttpStatus`. It may be the integer value `404` or the string representation of the enumeration `NOT_FOUND`.

application.yml.

    spring:
      cloud:
        gateway:
          routes:
          # =====================================
          - id: setstatusstring_route
            uri: http://example.org
            filters:
            - SetStatus=BAD_REQUEST
          - id: setstatusint_route
            uri: http://example.org
            filters:
            - SetStatus=401

In either case, the HTTP status of the response will be set to 401.

Prev |  | Next
4. Route Predicate Factories | Home | 6. Global Filters