gateway configuration

[Jean Pommier]

Hi

I'm wondering what exactly the line  trusted-proxies: .* in the gateway config (application.yaml) does. I remember seing or hearing  something about it but can't remember what.

The comments advise not to keep this param as-is, but are not very detailed about what or alternative config.

I couldn't find a mention of it in the gateway's doc.

Can someone shed some light on this config param ?

Thanks !

Jean

--

Jean Pommier -- pi-Geosolutions

Ingénieur, consultant indépendant

Tél. : (+33) 6 09 23 21 36
E-mail : j...@pi-geosolutions.fr
Web : www.pi-geosolutions.fr
linkedin : jean-pommier

[Pierre Mauduit]

Hi,

I'm wondering what exactly the line  trusted-proxies: .* in the gateway config (application.yaml) does. I remember seing or hearing  something about it but can't remember what.

The comments advise not to keep this param as-is, but are not very detailed about what or alternative config.

First, this is not georchestra specific, the fact that the parameter is under spring.cloud.gateway means it comes from that (upstream) project. We tend to keep georchestra-specific things under the georchestra configuration key whenever it is possible.

This is a security issue (see https://spring.io/security/cve-2025-41235 for more details) if the user can alter the X-Forwarded-* headers, as the gateway will trust them for several things. The trusted-proxies parameter allows to specify which (upstream) reverse proxy can be trusted, so that the webapp can (trust and) use the headers to figure out who is hitting it.

So basically, having the gateway behind a reverse proxy which sets the X-Forwarded-* and friends correctly, you are basically safe even with a ".*" regex (IMHO). But it could be even safer if you know the reverse proxy's IP to whitelist here.

-- Pierre

[Jean Pommier]

Hi Pierre

Thank you very much for the explanation, it's much clearer for me now.

So, if I wanted to secure it further, I'd configure here my own reverse proxy's IP, the one that sits in front of the Gateway.

Thanks !

Jean

Jean Pommier -- pi-Geosolutions

Ingénieur, consultant indépendant

Tél. : (+33) 6 09 23 21 36
E-mail : j...@pi-geosolutions.fr
Web : www.pi-geosolutions.fr
linkedin : jean-pommier

--
--
Vous avez reçu ce message, car vous êtes abonné au groupe
Groupe "georchestra" georc...@googlegroups.com
voir http://groups.google.fr/group/georchestra
 
Site web : http://www.georchestra.org

---
Vous recevez ce message, car vous êtes abonné au groupe Google georchestra.
Pour vous désabonner de ce groupe et ne plus recevoir d'e-mails le concernant, envoyez un e-mail à l'adresse georchestra...@googlegroups.com.
Pour afficher cette discussion, accédez à https://groups.google.com/d/msgid/georchestra/CAJ7mE39EWTeVXjqr595zA6v6MoYZzLw9p7DXa8MXqO4E1zOtvw%40mail.gmail.com.