Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
18.3.0
-
None
-
None
-
- Container image and tag: xwiki:18.3-postgres-tomcat
- Kubernetes, behind NGINX Gateway Fabric 2.7.2
- TLS terminates at the gateway; backend traffic uses HTTP
-
Unknown
-
Description
Summary:
When a Forwarded header is present alongside correct Host and
X-Forwarded-* headers, the root-page redirect uses an internal IP,
an unexpected port, and HTTP instead of the public HTTPS URL.
The problem can be reproduced by calling the Kubernetes Service
directly, bypassing the gateway.
Working request:
curl -sS -D - -o /dev/null \ http://xwiki.ns.svc.cluster.local/ \ -H 'Host: wiki.example.com' \ -H 'X-Forwarded-Host: wiki.example.com' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443'
Result:
HTTP/1.1 302
Location: https://wiki.example.com/bin/view/Main/
Failing request (only change: add Forwarded):
curl -sS -D - -o /dev/null \ http://xwiki.ns.svc.cluster.local \ -H 'Host: wiki.example.com' \ -H 'X-Forwarded-Host: wiki.example.com' \ -H 'X-Forwarded-Proto: https' \ -H 'X-Forwarded-Port: 443' \ -H 'Forwarded: by="10.0.0.1:443";for="192.0.2.1:12345";host="wiki.example.com";proto=https'
Actual result:
HTTP/1.1 302
Location: http://172.16.0.11:63190/bin/view/Main/
Expected result:
Location: https://wiki.example.com/bin/view/Main/
Workaround:
Suppress Forwarded for XWiki and retain Host and X-Forwarded-*.
Please investigate how the presence of Forwarded affects redirect
URL construction and interaction with X-Forwarded-* headers.
According to XWIKI-15505 and XWIKI-21710 handling of the Forwarded header should work.