Priority of X-Forwarded-Host vs X-Forwarded-Port

[shawkins]

With keycloak/keycloak#23023 it's noted that X-Forwarded-Port takes precedence over X-Forwarded-Host. That behavior is different than notable implementations including Wildfly, Jetty, and Django. Is this behavior intentional? And/or should it be configurable?

cc @vietj

[vietj]

The current behavior is currently hardcoded, I am not sure there is a rationale behind that, so I think we could make it configureable in Vert.x Web

[vietj]

The documentation for vertx-web however says:

  /**
   * Will process both {@link #FORWARD} and {@link #X_FORWARD}. Be aware that mixing the 2 headers can open
   * security holes as specially crafted requests that are not validated as proxy level can allow bypassing
   * the proxy desired forward value.
   *
   * For example, a proxy will add the {@code X-Forward-*} headers to a request but not filter out if the original
   * request includes the {@code Forward} header.
   */
  ALL

[shawkins]

Thank you for weighing in @vietj. So it doesn't appear anywhere that it's a documented expectation that X-Forwarded-Port takes precedence over X-Forwarded-Host? To resolve the issue from the keycloak side we added a migration and doc note about this behavior.

This just appears to be it's own special subcase/conflict when using X-Forward-* - that of course is not spelled out by any spec, but others have implemented the other way.

[sschu]

Please not there is also an open issue with a similar discussion: #35751