[
https://issues.apache.org/jira/browse/NIFI-16056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18092689#comment-18092689
]
David Handermann commented on NIFI-16056:
-----------------------------------------
The [Proxy
Configuration|https://nifi.apache.org/nifi-docs/administration-guide.html#proxy_configuration]
section of the Admin Guide has a fairly thorough review of the configuration
options, although it uses X-ProxyHost instead of X-Forwarded-Host in the
example. The X-Forwarded-Host option is mentioned. If you have any suggestions,
feel free to mention.
> X-Forwarded-Host could contain multiple comma-separated values, which leads
> to Invalid Proxy Hosts
> --------------------------------------------------------------------------------------------------
>
> Key: NIFI-16056
> URL: https://issues.apache.org/jira/browse/NIFI-16056
> Project: Apache NiFi
> Issue Type: Bug
> Affects Versions: 2.10.0
> Reporter: Yuanhao Zhu
> Priority: Major
>
> When NiFi sits behind a chain of reverse proxies that each append to
> {{X-Forwarded-Host}} (standard {{apr_table_mergen}} behavior in Apache httpd
> {{mod_proxy}} with {{{}ProxyAddHeaders On{}}}), the header arrives as a
> single field containing a comma-separated list, e.g.:
> {{X-Forwarded-Host: host.example.com, host.example.com}}
> {{ProxyHeaderValidatorCustomizer.processProxyHostHeaders}} reads the first
> field value and, after stripping a single trailing {{{}:port{}}}, compares
> the *entire string* against the request {{Host}} and the
> {{nifi.web.proxy.host}} allow-list. Because it does not split on comma, the
> value {{"host.example.com, host.example.com"}} is never found in the
> allow-list and the request is rejected with {*}HTTP 421 – Invalid Proxy Host
> Requested{*}, even though every individual value is a legitimate,
> allow-listed host.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
