Skip to content

Possibility of redirecting by specifying an abnormal port. #12816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kmabashi opened this issue Dec 12, 2022 · 0 comments · Fixed by #13197
Closed

Possibility of redirecting by specifying an abnormal port. #12816

kmabashi opened this issue Dec 12, 2022 · 0 comments · Fixed by #13197

Comments

@kmabashi
Copy link

kmabashi commented Dec 12, 2022

https://github.com/grails/grails-core/blob/f417f92076f1329f09bc44d34d45e4739d5244ad/grails-web-common/src/main/groovy/org/grails/web/servlet/mvc/GrailsWebRequest.java#L471-L474

In the above method, if "X-Forwarded-Proto" is given to the request header, the process does not give the port to the URL. As a result, the port number is arbitrarily removed from the redirect destination URL specification (HTTPheader.location) after login only when the application (Rundeck) accesses via AWS's ALB. Various problems are occurring in the application, such as login failures and CORS violation errors in client-side js. Is it possible to fix this?

AWS ALB automatically adds "X-Forwarded-Proto" to the HTTP header as officially stated.
https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/application/x-forwarded-headers.html

As a proposal for improvement, ALB also provides "X-Forwarded-Port". I have confirmed that the "X-Forwarded-Port" is 4440 for HTTP access to Rundeck via ALB. If this "X-Forwarded-Port" is in the HTTP header, how about modifying it to add it to the URL?

Please consider it.

puneetbehl added a commit that referenced this issue Nov 6, 2023
to read the PORT information from the request header when it is missing
in the request. This fixes #12816 where application is accesed via
AWS's ALB.
@puneetbehl puneetbehl linked a pull request Nov 6, 2023 that will close this issue
puneetbehl added a commit that referenced this issue Nov 6, 2023
to read the PORT information from the request header when it is missing
in the request. This fixes #12816 where application is accesed via
AWS's ALB.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant