Skip to content

Fix: skip response header modifications when the response is committed - #4328

Merged
ryanjbaxter merged 2 commits into
spring-cloud:mainfrom
JoeCqupt:fix/fix-3905
Oct 23, 2026
Merged

ryanjbaxter merged 2 commits into
spring-cloud:mainfrom
JoeCqupt:fix/fix-3905

Conversation

@JoeCqupt

Copy link
Copy Markdown
Contributor

fix #3905

Guard SetResponseHeader, RewriteResponseHeader, and DedupeResponseHeader
against modifying committed responses and add regression tests.

Fixes spring-cloudgh-3905

Signed-off-by: JoeCqupt <joe469391363@gmail.com>
@JoeCqupt

Copy link
Copy Markdown
Contributor Author

@ryanjbaxter PTAL

@ryanjbaxter ryanjbaxter left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you check SecureHeadersGatewayFilterFactory and RewriteLocationResponseHeaderGatewayFilterFactory as well?

Guard SecureHeaders and RewriteLocationResponseHeader against modifying
committed responses, and move the RewriteResponseHeader check into
filter so subclasses overriding rewriteHeaders keep the guard.

See spring-cloudgh-3905

Signed-off-by: joecqupt <joe469391363@gmail.com>
@JoeCqupt
JoeCqupt requested a review from ryanjbaxter October 19, 2026 02:39
@ryanjbaxter
ryanjbaxter merged commit a6e4b52 into spring-cloud:main Oct 23, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing check if the response is committed in some response filters

3 participants