fix: ignore query string when using X-Forwarded-Uri (ory#1025)

mvanderlee · Nov 8, 2022 · 6fa3978 · 6fa3978
1 parent ae9a754
commit 6fa3978
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/api/decision.go b/api/decision.go
@@ -45,7 +45,7 @@ func (h *DecisionHandler) ServeHTTP(w http.ResponseWriter, r *http.Request, next
 		r.URL.Scheme = x.OrDefaultString(r.Header.Get(xForwardedProto),
 			x.IfThenElseString(r.TLS != nil, "https", "http"))
 		r.URL.Host = x.OrDefaultString(r.Header.Get(xForwardedHost), r.Host)
-		r.URL.Path = x.OrDefaultString(r.Header.Get(xForwardedUri), r.URL.Path[len(DecisionPath):])
+		r.URL.Path = x.OrDefaultString(strings.SplitN(r.Header.Get(xForwardedUri), "?", 2)[0], r.URL.Path[len(DecisionPath):])
 
 		h.decisions(w, r)
 	} else {

diff --git a/api/decision_test.go b/api/decision_test.go
@@ -406,6 +406,17 @@ func TestDecisionAPIHeaderUsage(t *testing.T) {
 				req.Header.Add("X-Forwarded-Uri", "/bar")
 			},
 		},
+		{
+			name:           "argument from the headers doesn't get url encoded",
+			expectedUrl:    &url.URL{Scheme: "https", Host: "test.dev", Path: "/bar"},
+			expectedMethod: "POST",
+			transform: func(req *http.Request) {
+				req.Header.Add("X-Forwarded-Method", "POST")
+				req.Header.Add("X-Forwarded-Proto", "https")
+				req.Header.Add("X-Forwarded-Host", "test.dev")
+				req.Header.Add("X-Forwarded-Uri", "/bar?this=is&a=test")
+			},
+		},
 		{
 			name:           "only scheme is taken from the headers",
 			expectedUrl:    &url.URL{Scheme: "https", Host: defaultUrl.Host, Path: defaultUrl.Path},