Spring Boot firewall behind Apache2: malicious String "//"

user_11584969 0
Viewed 461

I am using a Spring Boot fat jar for serving backend and static files. I need to let it run behind an apache2. But I am getting the malicious string errors for "//" from the firewall:

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "//"
        at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:369) ~[spring-security-web-5.2.1.RELEASE.jar!/:5.2.1.RELEASE]
        at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:336) ~[spring-security-web-5.2.1.RELEASE.jar!/:5.2.1.RELEASE]
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194) ~[spring-security-web-5.2.1.RELEASE.jar!/:5.2.1.RELEASE]
...

My application properties are:

server:
  port: 9001
  address: 127.0.0.1
  forward-headers-strategy: framework

And my apache2 virtual host is:

<VirtualHost *:80>
   ServerName XXX

   ProxyPreserveHost on
   RequestHeader set X-Forwarded-Proto https
   RequestHeader set X-Forwarded-Port 443
   ProxyPass / http://localhost:9001/
   ProxyPassReverse / http://localhost:9001/

   RewriteEngine on
   RewriteCond %{SERVER_NAME} =XXX
   RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

Where "XXX" is the servername.

What am I missing here? I don't really want to reconfigure the firewall because I think there must be a solution without changing it.

spring-boot firewall apache2
1 Answers

To answer my question: I forgot to change the ssl confgiuration with:

<VirtualHost *:443>
  ...
</VirtualHost>

So if you have the same problem it may be the missing changes in the right config.

user_115849690
Related