Search code examples
nginxreverse-proxyrestlethateoas

Restlet how to build relates HATEAOS links properly?

Building a webapp behind a reverse proxy/load balancer, I need to get the correct original URL of the request (pre load balancer rewrite).

I have used getReference() (in the ServerResource) to add a self reference in the HATEAOS sense. However the doc says that the getReference() can be manipulated by the routing, and currently it does not include the correct scheme (http, instead of https - the load balancer terminates the https).

Here are the NGINX configs with regards to the headers forwarded.

location /api {
        proxy_pass http://test-service;
        proxy_pass_header X-Host;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X_FORWARDED_PROTO $scheme;
}

Is the reverse proxy config incorrect, or should I use the getOriginalReference() method. Is there some documentation that explains how the "original" reference is constructed, which fields are used behind a revers proxy.

Solution

  • I think that the support of the X-Forwarded-For header must be explicitly enabled in Restlet due to potential security issues.

    Here is the way to enable this feature as the server connector level:

    Component c = new Component();
Server server = c.getServers().add(Protocol.HTTP, 8182);
server.getContext().getParameters().add("useForwardedForHeader", "true");
c.start();

    See this page for more details: http://restlet.com/technical-resources/restlet-framework/guide/2.3/core/base/connectors.

    Once done, the corresponding hints are available in the ClientInfo object:

    List<String> forwardedAddresses
   = request.getClientInfo().getForwardedAddresses();

    See this page for the mapping between headers and Restlet API: http://restlet.com/technical-resources/restlet-framework/guide/2.2/core/http-headers-mapping.

    Hope this helps you, Thierry