SpringCloud/spring-cloud-gateway
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sync docs from master to gh-pages

Browse Source
This commit is contained in:
buildmaster
2018-04-24 08:12:23 +00:00
parent d2d39a71ad
commit e8bf535c55
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
multi/multi_gateway-request-predicates-factories.html
View File

@@ -102,7 +102,7 @@
</p><p>This route would match if the remote address of the request was, for example, <code class="literal">192.168.1.10</code>.</p><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="_modifying_the_way_remote_addresses_are_resolved" href="#_modifying_the_way_remote_addresses_are_resolved"></a>4.10.1&nbsp;Modifying the way remote addresses are resolved</h3></div></div></div><p>By default the RemoteAddr Route Predicate Factory uses the remote address from the incoming request.
This may not match the actual client IP address if Spring Cloud Gateway sits behind a proxy layer.</p><p>You can customize the way that the remote address is resolved by setting a custom <code class="literal">RemoteAddressResolver</code>.
Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the <a class="link" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For" target="_top">X-Forwarded-For header</a>, <code class="literal">XForwardedRemoteAddressResolver</code>.</p><p><code class="literal">XForwardedRemoteAddressResolver</code> has two static constructor methods which take different approaches to security:</p><p><code class="literal">XForwardedRemoteAddressResolver::trustAll</code> returns a <code class="literal">RemoteAddressResolver</code> which always takes the first IP address found in the <code class="literal">X-Forwarded-For</code> header.
This approach is vulnerable to spoofing, as a malicious client could set an initial value for the <code class="literal">X-Forwarded-For</code> which would be accepted by the resolver.</p><p><code class="literal">XForwardedRemoteAddressResolver::maxTrustedIndexX</code> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
This approach is vulnerable to spoofing, as a malicious client could set an initial value for the <code class="literal">X-Forwarded-For</code> which would be accepted by the resolver.</p><p><code class="literal">XForwardedRemoteAddressResolver::maxTrustedIndex</code> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used.
If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.</p><p>Given the following header value:</p><pre class="screen">X-Forwarded-For: 0.0.0.1, 0.0.0.2, 0.0.0.3</pre><p>The <code class="literal">maxTrustedIndex</code> values below will yield the following remote addresses.</p><div class="informaltable"><table style="border-collapse: collapse;border-top: 0.5pt solid ; border-bottom: 0.5pt solid ; border-left: 0.5pt solid ; border-right: 0.5pt solid ; "><colgroup><col class="col_1"><col class="col_2"></colgroup><thead><tr><th style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><code class="literal">maxTrustedIndex</code></th><th style="border-bottom: 0.5pt solid ; " align="left" valign="top">result</th></tr></thead><tbody><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>[<code class="literal">Integer.MIN_VALUE</code>,0]</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>(invalid, <code class="literal">IllegalArgumentException</code> during initialization)</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>1</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.3</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>2</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.2</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>3</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.1</p></td></tr><tr><td style="border-right: 0.5pt solid ; " align="left" valign="top"><p>[4, <code class="literal">Integer.MAX_VALUE</code>]</p></td><td style="" align="left" valign="top"><p>0.0.0.1</p></td></tr></tbody></table></div><p><a name="gateway-route-filters" href="#gateway-route-filters"></a>Using Java config:</p><p>GatewayConfig.java</p><pre class="programlisting">RemoteAddressResolver resolver = XForwardedRemoteAddressResolver
.maxTrustedIndex(<span class="hl-number">1</span>);

2
single/spring-cloud-gateway.html
View File

@@ -104,7 +104,7 @@ for details on setting up your build system with the current Spring Cloud Releas
</p><p>This route would match if the remote address of the request was, for example, <code class="literal">192.168.1.10</code>.</p><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="_modifying_the_way_remote_addresses_are_resolved" href="#_modifying_the_way_remote_addresses_are_resolved"></a>4.10.1&nbsp;Modifying the way remote addresses are resolved</h3></div></div></div><p>By default the RemoteAddr Route Predicate Factory uses the remote address from the incoming request.
This may not match the actual client IP address if Spring Cloud Gateway sits behind a proxy layer.</p><p>You can customize the way that the remote address is resolved by setting a custom <code class="literal">RemoteAddressResolver</code>.
Spring Cloud Gateway comes with one non-default remote address resolver which is based off of the <a class="link" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For" target="_top">X-Forwarded-For header</a>, <code class="literal">XForwardedRemoteAddressResolver</code>.</p><p><code class="literal">XForwardedRemoteAddressResolver</code> has two static constructor methods which take different approaches to security:</p><p><code class="literal">XForwardedRemoteAddressResolver::trustAll</code> returns a <code class="literal">RemoteAddressResolver</code> which always takes the first IP address found in the <code class="literal">X-Forwarded-For</code> header.
This approach is vulnerable to spoofing, as a malicious client could set an initial value for the <code class="literal">X-Forwarded-For</code> which would be accepted by the resolver.</p><p><code class="literal">XForwardedRemoteAddressResolver::maxTrustedIndexX</code> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
This approach is vulnerable to spoofing, as a malicious client could set an initial value for the <code class="literal">X-Forwarded-For</code> which would be accepted by the resolver.</p><p><code class="literal">XForwardedRemoteAddressResolver::maxTrustedIndex</code> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used.
If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.</p><p>Given the following header value:</p><pre class="screen">X-Forwarded-For: 0.0.0.1, 0.0.0.2, 0.0.0.3</pre><p>The <code class="literal">maxTrustedIndex</code> values below will yield the following remote addresses.</p><div class="informaltable"><table style="border-collapse: collapse;border-top: 0.5pt solid ; border-bottom: 0.5pt solid ; border-left: 0.5pt solid ; border-right: 0.5pt solid ; "><colgroup><col class="col_1"><col class="col_2"></colgroup><thead><tr><th style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><code class="literal">maxTrustedIndex</code></th><th style="border-bottom: 0.5pt solid ; " align="left" valign="top">result</th></tr></thead><tbody><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>[<code class="literal">Integer.MIN_VALUE</code>,0]</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>(invalid, <code class="literal">IllegalArgumentException</code> during initialization)</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>1</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.3</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>2</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.2</p></td></tr><tr><td style="border-right: 0.5pt solid ; border-bottom: 0.5pt solid ; " align="left" valign="top"><p>3</p></td><td style="border-bottom: 0.5pt solid ; " align="left" valign="top"><p>0.0.0.1</p></td></tr><tr><td style="border-right: 0.5pt solid ; " align="left" valign="top"><p>[4, <code class="literal">Integer.MAX_VALUE</code>]</p></td><td style="" align="left" valign="top"><p>0.0.0.1</p></td></tr></tbody></table></div><p><a name="gateway-route-filters" href="#gateway-route-filters"></a>Using Java config:</p><p>GatewayConfig.java</p><pre class="programlisting">RemoteAddressResolver resolver = XForwardedRemoteAddressResolver
.maxTrustedIndex(<span class="hl-number">1</span>);

2
spring-cloud-gateway.xml
View File

@@ -256,7 +256,7 @@ Spring Cloud Gateway comes with one non-default remote address resolver which is
<simpara><literal>XForwardedRemoteAddressResolver</literal> has two static constructor methods which take different approaches to security:</simpara>
<simpara><literal>XForwardedRemoteAddressResolver::trustAll</literal> returns a <literal>RemoteAddressResolver</literal> which always takes the first IP address found in the <literal>X-Forwarded-For</literal> header.
This approach is vulnerable to spoofing, as a malicious client could set an initial value for the <literal>X-Forwarded-For</literal> which would be accepted by the resolver.</simpara>
<simpara><literal>XForwardedRemoteAddressResolver::maxTrustedIndexX</literal> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
<simpara><literal>XForwardedRemoteAddressResolver::maxTrustedIndex</literal> takes an index which correlates to the number of trusted infrastructure running in front of Spring Cloud Gateway.
If Spring Cloud Gateway is, for example only accessible via HAProxy, then a value of 1 should be used.
If two hops of trusted infrastructure are required before Spring Cloud Gateway is accessible, then a value of 2 should be used.</simpara>
<simpara>Given the following header value:</simpara>