search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.86k stars 5.92k forks source link

StrictServerWebExchangeFirewall breaks spring-cloud-gateways RemoveRequestHeaderGatewayFilterFactory #16013

Closed sandra-markerud closed 1 month ago

sandra-markerud commented 1 month ago

Describe the bug With the update to spring-boot-3.3.5, our spring-cloud-gateway application breaks within the built-in "RemoveRequestHeaderGatewayFilterFactory". The exchange to be mutated is now a "StrictFirewallServerWebExchange". Those headers cannot be deleted anymore. Hence, the application throws an UnsupportedOperationException at org.springframework.http.ReadOnlyHttpHeaders.remove

To Reproduce Within a spring-cloud-gateway application define a route that has the "RemoveRequestHeaderGatewayFilterFactory" applied. Is has to be secured using spring-security (e.g. oauth).

Expected behavior No exception anymore but the filter to work again

Sample https://github.com/sandra-markerud/spring-cloud-gateway-upgrade The main branch contains a working application. The "RemoveRequestHeaderTest" shows, that everything works prior the upgrade. Additionally, the tooling folder contains a docker dompose file for a keycloak and mockserver and http requests for a live demo. The spring-boot_3.3.5 branch upgrades the application to spring-boot-3.3.5 and now the tests fails with the mentioned exception.

sjohnr commented 1 month ago

Thanks @sandra-markerud. I believe this is a duplicate of gh-15989. See this comment for the workaround in the meantime. Please let me know if I have misunderstood anything.

sandra-markerud commented 4 weeks ago

Thanks @sjohnr The proposed workaround works like a charm as I had indeed the same issue mentioned in the linked issue :)