Configuring embedded Jetty 9 for X-FORWARDED-PROTO with Spring Boot - spring

Question

I am running a Spring Boot application in AWS. The application is running behind an Elastic Load Balancer (ELB). The ELB is configured to use https (port 443) to the outside world, but passes through http (port 8080) to the application. The ELB is configured to pass through the x-forwarded-proto header. I am using Jetty 9.0.0.M0, with Spring Boot 1.1.5 RELEASE.
I appear to be getting incorrect redirects sent back from the application via the ELB where the redirect responses are coming back as http, rather than https. Now, I read here that I should set the "forwarded" header to true using:
<Set name="forwarded">true</Set>
I can't see how to do this with the embedded version of Jetty in Spring Boot because there is no XML configuration file as part of my source.
I have looked at the EmbeddedServletContainerCustomizer infrastructure but I still can't get the right incantation to get this setup to work.
The application is built and tested outside of the AWS https environment, so the application needs to transparently work with http too. Directly hitting the application endpoints without going through the ELB works. It's just that the ELB to application route that's not working.
Any ideas?

Answer 1

Had a similar issue myself and while researching stumbled across your question. I found this was quite easy to to programatically however isn't really explained in the Jetty docs.
The structure of the Jetty xml configuration files are matched by the structure of the java API so you can just replicate it in code.
So following the Jetty guide on how to configure using the XML configuration file here
I was able to configure the embedded server programatically like this:
Server server = new Server( port );
// Create HTTP Config
HttpConfiguration httpConfig = new HttpConfiguration();
// Add support for X-Forwarded headers
httpConfig.addCustomizer( new org.eclipse.jetty.server.ForwardedRequestCustomizer() );
// Create the http connector
HttpConnectionFactory connectionFactory = new HttpConnectionFactory( httpConfig );
ServerConnector connector = new ServerConnector(server, connectionFactory);
// Make sure you set the port on the connector, the port in the Server constructor is overridden by the new connector
connector.setPort( port );
// Add the connector to the server
server.setConnectors( new ServerConnector[] { connector } );

Answer 2

Try setting the following property in your spring boot application:
server.use-forward-headers=true
The will ensure the correct protocol is read from the header. Refer to documentation here:
https://docs.spring.io/spring-boot/docs/1.5.9.RELEASE/reference/html/howto-embedded-servlet-containers.html

Answer 3

I found a couple problems with the default Spring Boot Jetty configuration, not the least of which are enabled SSL algorithms which SSLLabs Check doesn't like.
Anyway: The fix I found for this was something like:
#Bean
public JettyEmbeddedServletContainerFactory jettyEmbeddedServletContainerFactory()
{
// Deploy the nuclear option, kill the default Spring Boot factory
// and replace with mine that disables extra crud.
JettyEmbeddedServletContainerFactory fac = new JettyEmbeddedServletContainerFactory();
// This allows ELB to work.
fac.setUseForwardHeaders( true );
return fac;
}
There are also a number of other ELB options that you need to setup if you want SSL end-to-end. I had to use the command line client with some tweaks and change the health checks to TCP:8443 b/c the EC2 instance certificates look invalid to the load balancer.

Answer 4

Here's what just worked for us with a Spring app behind jetty-runner-9.3.6.jar. In our case, our jetty.xml didn't have any addConnector already, and trying to add just the addConnector would error out.
Found it here - https://github.com/george-hawkins/authsite/blob/2c5d61b984a328ef878216a3acfd0ad2593f81b1/src/main/config/etc/jetty.xml
<New id="httpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
<Call name="addCustomizer">
<Arg><New class="org.eclipse.jetty.server.ForwardedRequestCustomizer"/></Arg>
</Call>
</New>
<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ServerConnector">
<Arg name="server"><Ref refid="Server" /></Arg>
<Arg name="factories">
<Array type="org.eclipse.jetty.server.ConnectionFactory">
<Item>
<New class="org.eclipse.jetty.server.HttpConnectionFactory">
<Arg name="config"><Ref refid="httpConfig" /></Arg>
</New>
</Item>
</Array>
</Arg>
<Set name="port"><SystemProperty name="jetty.port" default="8080"/></Set>
</New>
</Arg>
</Call>
What this DOES is to modify the Request object that is passed through to make it -look- like it didn't come through a proxy (replacing the details with whatever X-Forwarded headers are available and supported).
See http://archive.eclipse.org/jetty/9.0.0.M4/apidocs/index.html?org/eclipse/jetty/server/ForwardedRequestCustomizer.html
This customizer looks at at HTTP request for headers that indicate it has been forwarded by one or more proxies. Specifically handled are:
X-Forwarded-Host
X-Forwarded-Server
X-Forwarded-For
X-Forwarded-Proto
If these headers are present, then the Request object is updated so that the proxy is not seen as the other end point of the connection on which the request came

Answer 5

I have been unable to find a simple Jetty 9 solution to this question. Other than recommending that I upgrade to a later version of Jetty (which is good advice) I have received no other suggestions (at this time, as you can see)
My solution for the sake of expedience is to abandon Jetty, and instead to use embedded tomcat, where this functionality is a simple matter of configuration in the application.properties file. Simply add the following line to application.properties:
server.tomcat.remote_ip_header=x-forwarded-for
This appears to do the trick using the default embedded tomcat that comes as part of Spring Boot.