httpsec

func GuardHost ¶

func GuardHost(loopbackBind bool, trusted []string, next http.Handler) http.Handler

GuardHost rejects requests whose Host header does not name the local machine, when the server is bound to loopback.

Without this, a page on the internet can point a hostname it controls at 127.0.0.1 and have the visitor's own browser read the dashboard, the browser is inside the trust boundary even though the attacker is not. Checking Host costs nothing and closes it. trusted names additional Host values to accept, for the case where something in front of this server is terminating TLS and forwarding to loopback. A proxy passes the browser's original Host through, so `tailscale serve` and an ordinary nginx or Caddy front end all arrive at a loopback bind carrying a name this guard would otherwise refuse. Without a way to name them, the deployment SECURITY.md recommends returns 403 to every request.

They are named explicitly, one at a time, and there is no wildcard. The guard exists because an attacker chooses the Host header, so anything matching a pattern would hand back the thing being defended. A user who lists sheriff.example.com has said that name is theirs; that is a different statement from trusting whatever arrives.

func Headers ¶

func Headers(next http.Handler) http.Handler

Headers applies the standard security response headers.

func HostIsLoopback ¶

func HostIsLoopback(host string) bool

HostIsLoopback reports whether an HTTP Host header names the local machine. The Host may carry a port, and an IPv6 literal may be bracketed; both are stripped before the address is examined.

func IsLoopbackBind ¶

func IsLoopbackBind(listen string) bool

IsLoopbackBind reports whether a listen address only accepts connections from this machine. An empty host means every interface, which is not loopback.