Documentation
¶
Overview ¶
Package requestorigin resolves the scheme, host and client IP of an HTTP request. Forwarding headers (X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-For, X-Real-IP) are honoured only when the TCP peer is one of the configured reverse proxies (server.trusted_proxies); from any other peer they are ignored and the connection decides: https when it is TLS, the Host header, and the peer address.
Every value the kernel builds a URL from (install scripts, subscription links, webhook URLs, the request_scheme and request_host sent to package hosts) must come from here, so a client cannot make the server hand out links to a host of its choosing.
Index ¶
Constants ¶
const ( HeaderForwardedProto = "X-Forwarded-Proto" HeaderForwardedHost = "X-Forwarded-Host" HeaderForwardedFor = "X-Forwarded-For" HeaderRealIP = "X-Real-IP" )
Header names Control reads from a trusted proxy.
Variables ¶
var DefaultTrustedProxies = []string{"127.0.0.1/32", "::1/128"}
DefaultTrustedProxies is the trust list when server.trusted_proxies is not set: loopback only, so a reverse proxy on the same host (and Control's own UI server, which proxies /api to the API listener) keeps working.
Functions ¶
func IsForwardingHeader ¶
IsForwardingHeader reports whether name is a header a proxy uses to describe the original request (X-Forwarded-*, Forwarded, X-Real-IP). The kernel drops them from requests it hands on, after resolving the origin.
func NormalizeHost ¶
NormalizeHost validates a host[:port] authority and lower-cases it. It rejects anything else: a scheme, a path, user info, spaces or control characters, an empty or out-of-range port, an unbracketed IPv6 literal, and names that are not DNS-like labels or IP addresses.
func SetDefault ¶
func SetDefault(policy *Policy)
SetDefault makes policy the process-wide policy Resolve uses. The server sets it once at startup from server.trusted_proxies.
Types ¶
type Origin ¶
type Origin struct {
// Scheme is "http" or "https".
Scheme string
// Host is a validated host[:port], lower-cased; empty when the request
// carried no valid host.
Host string
// ClientIP is the client address (empty when none could be parsed).
ClientIP string
// Forwarded is true when a trusted proxy's headers set Scheme or Host.
Forwarded bool
}
Origin is where a request was addressed and who sent it.
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is a set of trusted proxy networks.
func NewPolicy ¶
NewPolicy parses proxies (IP addresses or CIDRs). A nil list is the default (DefaultTrustedProxies); an empty, non-nil list trusts no proxy.
func (*Policy) ApplyTo ¶
ApplyTo configures a gin engine with the same trust list, so Context.ClientIP (rate limits, login throttling, audit logs) honours X-Forwarded-For and X-Real-IP only from these proxies.
func (*Policy) ClientIP ¶
ClientIP returns the client address the way gin's Context.ClientIP does on an engine configured with ApplyTo: the peer address, unless the peer is trusted, in which case X-Forwarded-For is walked from the right past trusted proxies (then X-Real-IP).
func (*Policy) Resolve ¶
Resolve returns r's origin. Forwarding headers are read only when the TCP peer is trusted; the last value of a header (the one the nearest proxy wrote) is used, and a value that is not a plain http/https scheme or a valid host[:port] is ignored.
Source Files