Josh Cummings
51 lines
4.0 KiB
Plaintext
51 lines
4.0 KiB
Plaintext
[[http]]
|
|
= HTTP
|
|
|
|
All HTTP-based communication, including https://www.troyhunt.com/heres-why-your-static-website-needs-https/[static resources], should be protected by https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html[using TLS].
|
|
|
|
As a framework, Spring Security does not handle HTTP connections and thus does not provide support for HTTPS directly.
|
|
However, it does provide a number of features that help with HTTPS usage.
|
|
|
|
[[http-redirect]]
|
|
== Redirect to HTTPS
|
|
|
|
When a client uses HTTP, you can configure Spring Security to redirect to HTTPS in both xref:servlet/exploits/http.adoc#servlet-http-redirect[Servlet] and xref:reactive/exploits/http.adoc#webflux-http-redirect[WebFlux] environments.
|
|
|
|
[[http-hsts]]
|
|
== Strict Transport Security
|
|
|
|
Spring Security provides support for xref:features/exploits/headers.adoc#headers-hsts[Strict Transport Security] and enables it by default.
|
|
|
|
[[http-proxy-server]]
|
|
== Proxy Server Configuration
|
|
|
|
When using a proxy server, it is important to ensure that you have configured your application properly.
|
|
For example, many applications have a load balancer that responds to request for `\https://example.com/` by forwarding the request to an application server at `\https://192.168.0.107`
|
|
Without proper configuration, the application server can not know that the load balancer exists and treats the request as though `\https://192.168.0.107:8080` was requested by the client.
|
|
|
|
To fix this, the proxy needs to pass on the details of the original request, and the application needs to be configured to use them.
|
|
Two kinds of headers are used for this, and it is important to know which of them applies in your deployment:
|
|
|
|
* The standard `Forwarded` header, defined by https://tools.ietf.org/html/rfc7239[RFC 7239], which carries the original host, protocol, and client in a single header.
|
|
* The non-standard `X-Forwarded-*` headers, such as `X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-For`, which predate RFC 7239.
|
|
|
|
Most proxies still send the `X-Forwarded-*` headers rather than the standard `Forwarded` header, while Spring Framework and servers such as Reactor Netty and Jetty understand both.
|
|
Do not assume that only one of them is in use.
|
|
|
|
[NOTE]
|
|
====
|
|
Both kinds of headers are supplied by the client unless a proxy overwrites them, so an application that trusts them without a trusted proxy in front of it can be made to believe a request arrived over a different host, protocol, or client address than it really did.
|
|
====
|
|
|
|
For this reason, the proxy at the edge of your network must be configured to remove or overwrite any forwarded headers that arrive from the outside, for _both_ kinds of headers.
|
|
Dropping only the `Forwarded` header while passing through `X-Forwarded-*` (or the reverse) leaves the application open to the same spoofing through the other set.
|
|
Only headers added by a proxy you control should reach the application.
|
|
|
|
Once untrusted values are handled at the edge, the application server can be configured to apply the headers.
|
|
For example, Tomcat uses https://tomcat.apache.org/tomcat-10.1-doc/api/org/apache/catalina/valves/RemoteIpValve.html[`RemoteIpValve`] and Jetty uses https://eclipse.dev/jetty/javadoc/jetty-11/org/eclipse/jetty/server/ForwardedRequestCustomizer.html[`ForwardedRequestCustomizer`].
|
|
Alternatively, Spring users can use {spring-framework-reference-url}web/webmvc/filters.html#filters-forwarded-headers[`ForwardedHeaderFilter`] with the Servlet stack or {spring-framework-reference-url}web/webflux/reactive-spring.html#webflux-forwarded-headers[`ForwardedHeaderTransformer`] with the Reactive stack.
|
|
Both handle the `Forwarded` header and the `X-Forwarded-*` headers, and both can be configured to remove the headers instead of applying them, which is useful when the application is not behind a proxy.
|
|
|
|
Spring Boot users can use the `server.forward-headers-strategy` property to configure the application.
|
|
See the {spring-boot-reference-url}how-to/webserver.html#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details.
|