SOLR-18537: Proxy requests to a node via X-Solr-targetNode by dsmiley · Pull Request #5112 · apache/solr

dsmiley · 2026-10-12T23:12:24Z

https://issues.apache.org/jira/browse/SOLR-18537

It can be very useful for Solr to proxy requests to another node, specified in a header or param. The intended scenario is when there's an HTTP proxy in front of Solr, and the backing Solr nodes aren't directly reachable. Solr is doing that now for a few admin endpoints that have already been coded for it, using GenericV1RequestProxy internally (e.g. for logging, info, ...). The issue here instead proposes a generic mechanism that doesn't require Solr handlers to be coded any differently.

Header or param. Useful to reach a specific node. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

dsmiley · 2026-10-12T23:13:48Z

FYI I've been using this for awhile at work.
Marking as Draft because needs a test and documentation.

Are there security concerns here? I don't think so. This is live-nodes only.

code: use Solr's URL param parsing

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

janhoy

I delegate review to Copilot who is probably better at servlet spec than me. I do like the general solution and I believe the security aspect is handled so so far a LGTM from me from 10.000 ft

janhoy

Some manual review comments as I'm out of copilot credit...

Copilot

🟡 Changes recommended

Caller identity preservation and request-routing correctness need correction before approval.

5 open issues

_{Review effort: Balanced}

dsmiley · 2026-10-22T15:08:52Z

+      HttpClient httpClient =
+          ((HttpJettySolrClient) cores.getDefaultHttpSolrClient()).getHttpClient();
+      HttpSolrProxy.doHttpProxy(httpClient, req, resp, url);


I'm investigating this separately.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…uting loops Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…icationFilter Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… caller Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

dsmiley · 2026-10-22T16:00:29Z

It's really remarkable how much this PR has improved/evolved as a result of such peer-review/scrutiny.

dsmiley · 2026-10-22T22:24:25Z

technically, this aspect is a small bug fix to possible encoding issue in the path. That's very unlikely to happen in practice IMO.

dsmiley · 2026-10-22T22:27:31Z

+    // also accept it as a query param on GET requests, for convenience when a header can't
+    // easily be set (e.g. a browser address bar)
+    String queryString = req.getQueryString();
+    if ("GET".equals(req.getMethod())
+        && queryString != null
+        && queryString.contains(TARGET_NODE_HEADER)) { // cheap; avoid double-parse
+      SolrParams params = SolrRequestParsers.parseQueryString(queryString);
+      if (targetNode != null && params.get(TARGET_NODE_HEADER) != null) {
+        res.sendError(400, TARGET_NODE_HEADER + " must EITHER be a header or url param");
+        return;
+      }
+      targetNode = params.get(TARGET_NODE_HEADER);
+      if (targetNode != null) {
+        queryString = filterQueryString(params);
+      }
+    }
+


there is non-trivial complexity to support the query string option, particularly for removal. It's a sunk costs as this point -- it works, tested, etc. The motivation is to make this easy for a user with their browser.

dsmiley · 2026-10-22T22:31:27Z

+    // wrap the request to filter out the header & param.
+    //   NOTE: we assume downstream processing only accesses such data via what we override !!


an alternative would be to enhance HttpSolrProxy to directly do this. The header part would trivially be one line in hop-by-hop headers with a comment justification. I don't love the coupling but it's in the same package.

SOLR-18537: Proxy requests to a node via X-Solr-targetNode

ab0ebb8

Header or param. Useful to reach a specific node. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

dsmiley requested review from gerlowskija and janhoy October 12, 2026 23:12

github-actions Bot added jetty-server admin-ui labels Oct 12, 2026

janhoy mentioned this pull request Oct 20, 2026

SOLR-12613: node picker for cross-node screens #5110

Open

test + ref guide.

4616e92

code: use Solr's URL param parsing

github-actions Bot added documentation Improvements or additions to documentation test-framework tests labels Oct 20, 2026

dsmiley marked this pull request as ready for review October 20, 2026 20:42

janhoy requested a balanced review from Copilot October 21, 2026 08:49

Copilot AI reviewed Oct 21, 2026

janhoy reviewed Oct 21, 2026

View reviewed changes

Comment thread solr/core/src/java/org/apache/solr/servlet/NodeTargetProxyFilter.java Outdated

Comment thread solr/core/src/java/org/apache/solr/servlet/NodeTargetProxyFilter.java Outdated

Comment thread solr/core/src/java/org/apache/solr/servlet/NodeTargetProxyFilter.java Outdated

janhoy requested a balanced review from Copilot October 21, 2026 09:07

Copilot started reviewing on behalf of janhoy October 21, 2026 09:07

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

dsmiley and others added 9 commits October 21, 2026 19:43

NodeTargetProxyFilter: review tweaks

d1882d9

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

NodeTargetProxyFilter: preserve full node names with dotless hosts

176ffcb

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

rename var to match super

7c66491

NodeTargetProxyFilter: consume the targeting header/param to avoid ro…

1d7fc1a

…uting loops Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

NodeTargetProxyFilter: proxy using the still-encoded request path

b5cb63b

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

NodeTargetProxyFilterTest: use SolrJ so it works with SSL

b4dba65

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

NodeTargetProxyFilter: report errors directly so they survive Authent…

de525ca

…icationFilter Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

NodeTargetProxyFilterAuthTest: proxied requests are authorized as the…

d033e8b

… caller Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

HttpSolrProxy: take a URI; build it with an encoded path and query

b4fa46f

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

dsmiley commented Oct 22, 2026

View reviewed changes

		// wrap the request to filter out the header & param.
		// NOTE: we assume downstream processing only accesses such data via what we override !!

Conversation

dsmiley commented Oct 12, 2026

Uh oh!

dsmiley commented Oct 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

janhoy left a comment

Choose a reason for hiding this comment

Uh oh!

janhoy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

dsmiley Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dsmiley commented Oct 22, 2026

Uh oh!

dsmiley Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

dsmiley Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

dsmiley Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants