diff --git a/multi/multi_gateway-request-predicates-factories.html b/multi/multi_gateway-request-predicates-factories.html index 091de917..41a173fe 100644 --- a/multi/multi_gateway-request-predicates-factories.html +++ b/multi/multi_gateway-request-predicates-factories.html @@ -101,11 +101,11 @@ - RemoteAddr=192.168.1.1/24

This route would match if the remote address of the request was, for example, 192.168.1.10.

4.10.1 Modifying the way remote addresses are resolved

By default the RemoteAddr Route Predicate Factory uses the remote address from the incoming request. This may not match the actual client IP address if Spring Cloud Gateway sits behind a proxy layer.

You can customize the way that the remote address is resolved by setting a custom RemoteAddressResolver. -Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the X-Forwarded-For header, XForwardedRemoteAddressResolver.

XForwardedRemoteAddressResolver has two static constructor methods which take different approaches to security:

XForwardedRemoteAddressResolver::trustAllXForwardedRemoteAddressResolver returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header. -This approach is vulnerable to spoofing, as a malicious client could set an initial value for the X-Forwarded-For which would be accepted by the resolver.

XForwardedRemoteAddressResolver::maxTrustedIndexXForwardedRemoteAddressResolver takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway. +Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the X-Forwarded-For header, XForwardedRemoteAddressResolver.

XForwardedRemoteAddressResolver has two static constructor methods which take different approaches to security:

XForwardedRemoteAddressResolver::trustAll returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header. +This approach is vulnerable to spoofing, as a malicious client could set an initial value for the X-Forwarded-For which would be accepted by the resolver.

XForwardedRemoteAddressResolver::maxTrustedIndexX takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway. If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used. If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.

Given the following header value:

X-Forwarded-For: 0.0.0.1, 0.0.0.2, 0.0.0.3

The maxTrustedIndex values below will yield the following remote addresses.

maxTrustedIndexresult

[Integer.MIN_VALUE,0]

(invalid, IllegalArgumentException during initialization)

1

0.0.0.3

2

0.0.0.2

3

0.0.0.1

[4, Integer.MAX_VALUE]

0.0.0.1

Using Java config:

GatewayConfig.java

RemoteAddressResolver resolver = XForwardedRemoteAddressResolver
-    .maxTrustedIndexXForwardedRemoteAddressResolver(1);
+    .maxTrustedIndex(1);
 
 ...
 
diff --git a/single/spring-cloud-gateway.html b/single/spring-cloud-gateway.html
index cae59765..afdb7df7 100644
--- a/single/spring-cloud-gateway.html
+++ b/single/spring-cloud-gateway.html
@@ -103,11 +103,11 @@ for details on setting up your build system with the current Spring Cloud Releas
         - RemoteAddr=192.168.1.1/24

This route would match if the remote address of the request was, for example, 192.168.1.10.

4.10.1 Modifying the way remote addresses are resolved

By default the RemoteAddr Route Predicate Factory uses the remote address from the incoming request. This may not match the actual client IP address if Spring Cloud Gateway sits behind a proxy layer.

You can customize the way that the remote address is resolved by setting a custom RemoteAddressResolver. -Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the X-Forwarded-For header, XForwardedRemoteAddressResolver.

XForwardedRemoteAddressResolver has two static constructor methods which take different approaches to security:

XForwardedRemoteAddressResolver::trustAllXForwardedRemoteAddressResolver returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header. -This approach is vulnerable to spoofing, as a malicious client could set an initial value for the X-Forwarded-For which would be accepted by the resolver.

XForwardedRemoteAddressResolver::maxTrustedIndexXForwardedRemoteAddressResolver takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway. +Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the X-Forwarded-For header, XForwardedRemoteAddressResolver.

XForwardedRemoteAddressResolver has two static constructor methods which take different approaches to security:

XForwardedRemoteAddressResolver::trustAll returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header. +This approach is vulnerable to spoofing, as a malicious client could set an initial value for the X-Forwarded-For which would be accepted by the resolver.

XForwardedRemoteAddressResolver::maxTrustedIndexX takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway. If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used. If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.

Given the following header value:

X-Forwarded-For: 0.0.0.1, 0.0.0.2, 0.0.0.3

The maxTrustedIndex values below will yield the following remote addresses.

maxTrustedIndexresult

[Integer.MIN_VALUE,0]

(invalid, IllegalArgumentException during initialization)

1

0.0.0.3

2

0.0.0.2

3

0.0.0.1

[4, Integer.MAX_VALUE]

0.0.0.1

Using Java config:

GatewayConfig.java

RemoteAddressResolver resolver = XForwardedRemoteAddressResolver
-    .maxTrustedIndexXForwardedRemoteAddressResolver(1);
+    .maxTrustedIndex(1);
 
 ...
 
diff --git a/spring-cloud-gateway.xml b/spring-cloud-gateway.xml
index c4ddf9d5..3398e9ef 100644
--- a/spring-cloud-gateway.xml
+++ b/spring-cloud-gateway.xml
@@ -254,9 +254,9 @@ This may not match the actual client IP address if Spring Cloud Gateway sits beh
 You can customize the way that the remote address is resolved by setting a custom RemoteAddressResolver.
 Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the X-Forwarded-For header, XForwardedRemoteAddressResolver.
 XForwardedRemoteAddressResolver has two static constructor methods which take different approaches to security:
-XForwardedRemoteAddressResolver::trustAllXForwardedRemoteAddressResolver returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header.
+XForwardedRemoteAddressResolver::trustAll returns a RemoteAddressResolver which always takes the first IP address found in the X-Forwarded-For header.
 This approach is vulnerable to spoofing, as a malicious client could set an initial value for the X-Forwarded-For which would be accepted by the resolver.
-XForwardedRemoteAddressResolver::maxTrustedIndexXForwardedRemoteAddressResolver takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
+XForwardedRemoteAddressResolver::maxTrustedIndexX takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
 If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used.
 If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.
 Given the following header value:
@@ -299,7 +299,7 @@ If two hops of trusted infrastructure are required before Spring Cloud Gateway i
 Using Java config:
 GatewayConfig.java
 RemoteAddressResolver resolver = XForwardedRemoteAddressResolver
-    .maxTrustedIndexXForwardedRemoteAddressResolver(1);
+    .maxTrustedIndex(1);
 
 ...