[FELIX-4330] [HTTP SSL Filter] Make SSL header(s) configurable

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: http-2.2.1
• Fix Version/s: http-2.3.0, http.sslfilter-0.1.0
• Component/s: HTTP Service
• Assignee: Unassigned
• Reporter: Felix Meschberger
• Created: 25/Nov/13 12:25
• Updated: 23/Nov/17 15:00
• Resolved: 20/May/14 15:11

Description

The request header indicating a proxy terminating an HTTPS connection is currently hard coded to be "X-Forwarded-SSL" with the only value supported to be "on" – based on the assumption of this being the most commonly used header value.

It looks that Amazon's Elastice Load Balancer uses a different header and value: X-Forwarded-Proto whose value is the actual protocol by which the client talks to the load balancer. The filter should kick in if the protocol is https (or maybe if it is just not the same as the one which the servlet container reports).

[1] http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/TerminologyandKeyConcepts.html#x-forwarded-proto

Issue Links

• is related to: FELIX-5750 Clarify relation of "Enable Proxy/Load Balancer Connection" Jetty feature and SSL Filter