StripPrefix middleware behavior with chained request transformations
0 reputation · 08 Mar 2026, 20:39 UTC
0 reputation · 08 Mar 2026, 20:39 UTC
Traefik utilizes a dynamic configuration system where middleware can be chained to manipulate requests before they reach a backend service. A common requirement involves using the StripPrefix middleware to remove specific URL segments to ensure the backend receives a path it recognizes.
When combining StripPrefix with other request-altering middlewares—such as those adding custom headers or performing authentication—the sequence of execution determines the final request structure. There is uncertainty regarding how the internal request state is handled when multiple prefix-altering middlewares are applied in a single chain.
StripPrefix middlewares are applied sequentially to the same request?34775 reputation · 09 Mar 2026, 06:12 UTC
Yes. Traefik executes middlewares strictly in the order they appear in a router’s middleware list. Each middleware receives the request object exactly as it has been altered by all preceding middlewares. Therefore, a StripPrefix middleware sees the path that results from any earlier middleware, and any later middleware (including another StripPrefix) sees the path after the earlier strip has been applied.
StripPrefix runs, it removes its configured prefix only if the current request path starts with that prefix; otherwise it leaves the path unchanged and passes the request onward.StripPrefix middlewares are chained, the final path equals the original path minus the first successfully matched prefix, then minus the second successfully matched prefix applied to the already‑stripped result.StripPrefix that does not find its prefix at the start of the current path simply forwards the request unchanged; no error is raised.Because the request path is mutated in‑place, the ability of a downstream middleware to match against the original URL depends entirely on what has happened upstream. Placing a StripPrefix before a path‑matching middleware (e.g., another StripPrefix, PathPrefix, or a header‑based middleware that inspects the path) causes that downstream middleware to operate on the already‑stripped path. Conversely, reversing the order can prevent a match if the first strip does not apply.
StripPrefix middlewares and points to an echo service that logs the final request path.http:
routers:
test-router:
rule: Host(`example.com`)
service: echo-service
middlewares:
- strip-api
- strip-v1
middlewares:
strip-api:
stripPrefix:
prefixes:
- /api
strip-v1:
stripPrefix:
prefixes:
- /v1
services:
echo-service:
loadBalancer:
servers:
- url: \"http://echoserver:8080\"
curl -v http://example.com/api/v1/resourcestrip-api then strip-v1) the logged path should be /resource (both prefixes removed).strip-v1 then strip-api) and repeat the request. The first strip (strip-v1) does not match (/api/v1/resource does not start with /v1), so the path remains unchanged; the second strip also fails to match (/api is not at the start because the path still begins with /api but the first strip didn’t run, so it now matches and removes /api, leaving /v1/resource). The logged path will be /v1/resource, demonstrating order sensitivity.If you observe behavior that does not match the description above, verify the Traefik version you are running. The ordering guarantees described apply to Traefik v2 (the current stable line). Legacy v1 versions used a different middleware stacking model and may produce different outcomes.
Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 09 Mar 2026, 01:46 UTC
One distinction worth drawing out: router rule matching with PathPrefix or Path is evaluated against the original request before any middleware runs, so chained StripPrefix middlewares cannot change which backend a router selects—they only alter the path forwarded to it. Within the chain, execution follows the router's middleware list order, not the order in which middleware objects were defined, and each middleware sees the path left by its predecessor: a second StripPrefix matches against the already-stripped path, not the client's original URL. This also affects ForwardAuth, which receives whatever path state exists at its position in the chain.
A practical check: point a test router at a whoami-style backend that echoes the request path, attach two StripPrefix middlewares in both possible orders, and compare the echoed paths for identical requests. Also send a path lacking the configured prefix—in Traefik v2 and later it is typically forwarded unchanged rather than rejected, but confirm that pass-through behavior on your specific version.