Port is double reported when using Apache Strategy

[ZuSe]

When setting the apache address strategy to X-Forward the bundles (next parameter) get returned with twice the port.

hapi:
fhir:
### This is the FHIR version. Choose between, DSTU2, DSTU3, R4 or R5
fhir_version: R5
### enable to use the ApacheProxyAddressStrategy which uses X-Forwarded-* headers
### to determine the FHIR server address
use_apache_address_strategy: true
### forces the use of the https:// protocol for the returned server address.
### alternatively, it may be set using the X-Forwarded-Proto header.
use_apache_address_strategy_https: true

Here a small request chain to visualize what happens:

REQ
curl --location --request GET 'https://fhir-dev.iatros.dev/fhir/Observation'
RESP

    "type": "searchset",
    "link": [
        {
            "relation": "self",
            "url": "https://fhir-dev.iatros.dev:443/fhir/Observation"
        },
        {
            "relation": "next",
            "url": "https://fhir-dev.iatros.dev:443/fhir?_getpages=d581a147-de74-49d0-8dae-8b7dd76038dd&_getpagesoffset=500&_count=500&_pretty=true&_bundletype=searchset"
        }
    ],

Using the searchset url from next

REQ
curl --location --request GET 'https://fhir-dev.iatros.dev:443/fhir?_getpages=d581a147-de74-49d0-8dae-8b7dd76038dd&_getpagesoffset=500&_count=500&_pretty=true&_bundletype=searchset'
RESP

    "link": [
        {
            "relation": "self",
            "url": "https://fhir-dev.iatros.dev**:443:443/**fhir?_getpages=d581a147-de74-49d0-8dae-8b7dd76038dd&_getpagesoffset=500&_count=500&_pretty=true&_bundletype=searchset"
        },
        {
            "relation": "next",
            "url": "https://fhir-dev.iatros.dev:443:443/fhir?_getpages=d581a147-de74-49d0-8dae-8b7dd76038dd&_getpagesoffset=1000&_count=500&_pretty=true&_bundletype=searchset"
        },
        {
            "relation": "previous",
            "url": "https://fhir-dev.iatros.dev:443:443/fhir?_getpages=d581a147-de74-49d0-8dae-8b7dd76038dd&_getpagesoffset=0&_count=500&_pretty=true&_bundletype=searchset"
        }
    ],

This behavior occurred after upgrading from 5.5.-PRE2 to 5.5-PRE7, somewhere in between it might got broken.
Due to lack of time I can't debug further at this point, sorry for that

[chgl]

I ran into the same situation as well, but this isn't a recent change but a bug in either your proxy server or the ApacheAddressStrategy implementation (whichever you prefer). It occurs because the proxy sets x-forwarded-host to fhir-dev.iatros.dev:443 instead of just fhir-dev.iatros.dev and the strategy just appends x-forwarded-port to the host (see https://github.com/hapifhir/hapi-fhir/blob/d1c2d839d187b0820e3c38658a2fef889a908dd3/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/ApacheProxyAddressStrategy.java#L118), you get fhir-dev.iatros.dev:443:443.

I faced this when using https://github.com/chimurai/http-proxy-middleware to forward requests via NodeJS to a FHIR server and worked around it by removing the x-forwarded-port header: proxyReq.removeHeader("X-Forwarded-Port");.

[ZuSe]

Hi @chgl
I think the proper way here would be to fix the apache strategy implementation.

The proxy server is unchangeable (nginx ingress on kubernetes) and works fine with all other application in the cluster.

[chgl]

I tend to agree. I think a better place for the issue would then be https://github.com/hapifhir/hapi-fhir. I guess the fix would be if the X-Forwarded-Host already contains a port, then X-Forwarded-Port should be ignored if both ports are the same. Not entirely sure what to do if they differ, though.

Maybe the apache strategy (or a new one?) should also support the more standardized https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded header - where the above mentioned issue won't be a concern since there's only one place where a port may be used.

[culpinnis]

I can confirm the issue using Traefik as reverse proxy, too.

[github-actions]

This issue is stale because it has been open 730 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.