Re: Tomcat 9.0.37 - Request Header Parsing Exception: X-Forwarded-For Lost and Host Field Duplicated Resulting in 400 Bad Request

扛起一片天！✨,

On 4/1/26 9:29 PM, 扛起一片天！✨ wrote:
> Hi ,
> 
> 
> Thank you for your reply. 
> Request chain:
> Client → springcloud gateway(12.52.41.10:8080) → Tomcat (127.0.0.1:8001)
> The  springcloud gateway configuration has added the X-Forwarded-* series of headers. 
> 2. Regarding the format:
> The original request is a string dumped from the inputBuffer of Tomcat.
> There may be issues with line breaks when pasting, but in the actual request, each header is on a separate line. 
> 
> 
> 3. Version Information:
> - Spring Boot: 2.3.2.RELEASE
> - Embedded Tomcat: 9.0.37
> - JDK: 1.8
> 
> 
> Regarding the upgrade:
> Due to the constraints of the production environment, an upgrade cannot be carried out in the short term.
> I would like to first confirm if this is a known issue or if there is a workaround? 

I'm sorry to put this in these terms, but...

You are presumably paid for your work on your environment, and I'm not 
paid to work on your environment or even to work on Tomcat. I'm a 
volunteer and you are responsible for resolving this issue that is 
affecting you. I'm not going to do the work to determine if this is a 
"known issue" (all known issues are either actively being worked on - 
publicly - or have already been fixed). The best way to determine if 
it's a "known issue" is by upgrading to the latest version and trying 
it. If it *was* a known issue, it will have been fixed.

> Supplementary phenomena:
> - The issue occurs sporadically and not with every request.
> - When the X-Forwarded-For header is missing, it is always accompanied by a repeated Host field.
> - It is suspected that the problem lies in the header boundary judgment during the parsing of
 > Http11InputBuffer. 

Suspected by whom, and with what evidence?
> Could you guide me on how to further debug or provide the relevant issue link? 

If this is repeatable, then repeat it in a testing environment with 
upgraded versions and not in production.

Or, since you are using spring cloud gateway, spin-up a server that only 
gets traffic with e.g. some custom header, and add that custom header to 
all your test cases. Then you are testing "in production" but not 
interfering with it.

-chris