Repository navigation
Conversation
This was referenced Nov 3, 2026
jyx-07
force-pushed
the
feat/gateway-request-sanitize
branch
from
November 3, 2026 14:14
768ef92 to
22e0a48
Compare
jyx-07
force-pushed
the
feat/gateway-request-sanitize
branch
from
November 3, 2026 14:19
22e0a48 to
de8e991
Compare
cfcromn
reviewed
Nov 3, 2026
cfcromn
left a comment
cfcromn
left a comment
There was a problem hiding this comment.
쿼리 토큰 제거와 IPv6 호스트 처리에서 확인한 내용 남깁니다.
| private fun withoutTokenQuery(uri: URI): URI = | ||
| UriComponentsBuilder | ||
| .fromUri(uri) | ||
| .replaceQueryParam(TOKEN_QUERY) |
There was a problem hiding this comment.
?%74oken=JWT로 요청해 보니 인증은 통과하는데 토큰이 쿼리에 그대로 남았습니다. 인증할 때는 디코딩된 키를 읽고, 여기서는 원문 키를 기준으로 지워서 생기는 차이 같습니다. 서비스 URL 로그에 JWT가 남을 수 있으니 디코딩한 키가 token인 파라미터도 같이 제거하면 좋지 않을까요?
Contributor
Author
| val own = | ||
| Forwarded( | ||
| proto = proto, | ||
| host = headers.getFirst(HttpHeaders.HOST)?.substringBefore(':') ?: uri.host.orEmpty(), |
There was a problem hiding this comment.
IPv6 주소는 이 방식으로 자르면 안 될 것 같습니다. Host: [::1]:8080이면 결과가 [가 되고, 이 값이 X-Forwarded-Host로 전달돼 downstream Spring에서 URI를 만들 때 예외가 발생합니다. 여기서는 request.uri.host를 쓰면 IPv6도 처리할 수 있을 것 같아요.
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
개요
클라이언트가 게이트웨이 소유 헤더를 위조해도 올바른 값으로 바꿔 넘기고, 형식이 잘못된 요청은 400으로 막습니다.
본문
X-User-Id,X-Real-IP,X-Forwarded-*,Forwarded,X-Internal-*를 지우고 게이트웨이가 판별한 값으로 다시 씀..,%2e,%2f,%5c,//)과 제어문자 헤더는 400, 8KB 넘는 헤더는 431?token=은 검증 후 지우고 서비스에 넘김,/{prefix}/v3/api-docs는 토큰 없이 허용#10 → #12 → 이 PR 순서로 머지해 주세요.