spring-web - Exchange response header values are overridden from the downstream calls

[explorer-fullstack]

Affects: <5.3.16 & up> (don't have this issue in 5.3.13)

As far as I've tested back, atleast beginning 5.3.16 this issue is occurring. To be specific, observed this issue in both spring-web 5.3.16 & spring-web 5.3.18

Issue Description:
Sequence of steps:

1. Spring Cloud Gateway(SCG) received the request
2. SCG added set of response headers to the exchange object
3. SCG makes the downstream call
4. Downstream sets the same exact headers that were set in step#2 but with different values

What should've happened (and this is what happens with spring-web 5.3.13)?

• The response headers added by the downstream gets saved into exchange. If the downstream is setting the same response headers which are already present in the exchange, then the response header values from downstream saved into the "value" array

What's happening (and this is what happens at least beginning spring-web 5.3.16)?

• If the downstream is setting the same response headers which are already present in the exchange, then the response header values are not added to the header "value" object but overrides the response header values that was already set on the exchange prior to making a downstream call

Notes:
I've tested this scenario in different combinations and below are the findings

Springboot 2.5.7 (spring-web: 5.3.13) - No issue
Springboot 2.5.12 with spring-web: 5.3.18 - Issue present
Springboot 2.5.12 with spring-web: 5.3.16 - Issue present
Springboot 2.5.7 (spring-web: 5.3.18/16) - Issue present
Springboot 2.6.4 (spring-web: 5.3.16) - Issue present

Please advise and let me know if you have any questions.

Thanks.

[poutsma]

Since 5.3.14 Spring WebFlux ServerResponse instances overwrite headers that already exist, see #27741. This was by design.

I do not work on Spring Cloud Gateway, so I do not know how the resolution of #27741 relates to that project. Can you share any insights, @spencergibb ?

[spencergibb]

What version of gateway? We just made a change to merge response headers in spring-cloud/spring-cloud-gateway#2547

[explorer-fullstack]

What version of gateway? We just made a change to merge response headers in spring-cloud/spring-cloud-gateway#2547

@spencergibb - I've started facing this issue since I upgraded to Springboot 2.5.12 (spring-cloud-gateway-server:3.0.3). I've not upgraded the Spring cloud dependencies and kept it as it was at 2020.0.3

But this works just fine with Springboot 2.5.7 & the same version of spring-cloud-gateway-server:3.0.3. This is the reason why i thought spring-web upgrade to 5.3.18 (brought in by Springboot 2.5.12) is causing this issue.

I also tested several other combinations and this is what I found:

Springboot 2.5.7 with spring-web: 5.3.13 & spring-cloud 2020.0.3 - No issue
Springboot 2.5.12 with spring-web: 5.3.18 & spring-cloud 2020.0.3 - Issue present
Springboot 2.5.12 with spring-web: 5.3.16 & spring-cloud 2020.0.3 - Issue present
Springboot 2.5.7 with spring-web: 5.3.18/16 & spring-cloud 2020.0.3 - Issue present
Springboot 2.6.4 with spring-web: 5.3.16 & spring-cloud 2021.0.1 - Issue present
Springboot 2.6.6 with spring-web: 5.3.18 & spring-cloud 2021.0.1 - Issue present

Im curious why the Springboot/spring-web upgrade causing this issue as the original issue is with NettyRoutingFilter which is part of spring-cloud-gateway-server jar

Do you know approximately when will you be releasing the general availability version which will include this fix?

[bclozel]

It seems this has been solved in Spring Cloud Gateway directly with version 3.1.2.