Documentation
¶
Index ¶
Constants ¶
const DefaultMaxHttpResponseSize = 1024 * 1024
DefaultMaxHttpResponseSize is a default maximum size of an HTTP response body that will be read. Very large or unbounded HTTP responses can cause denial-of-service, so it's good to limit how much data is read. This of course heavily depends on the use case, but 1MB is a reasonable default.
Variables ¶
var DefaultCachingTransport http.RoundTripper
DefaultCachingTransport is a http.RoundTripper that can be used as a default transport for HTTP clients. If caching is enabled, it will cache responses according to RFC 7234. If caching is disabled, it will behave like our safe http.SafeHttpTransport.
var SafeHttpTransport *http.Transport
SafeHttpTransport is a http.Transport that can be used as a default transport for HTTP clients. It carries the strict-mode SSRF dial guard (see denyNonPublicAddr), but only that: the HTTPS requirement, the redirect-downgrade check and the response size limit live on StrictHTTPClient. Do not build a raw http.Client on this transport for outbound requests; use the New* constructors so all strict-mode protections apply.
var StrictMode bool
StrictMode is a flag that can be set to true to enable strict mode for the HTTP client.
Functions ¶
func SetAllowedNonPublicCIDRs ¶
SetAllowedNonPublicCIDRs parses the given CIDR strings and replaces the set of non-public networks that strict mode permits. It returns an error on the first invalid CIDR, leaving the previous value unchanged.
func SetDeniedCIDRs ¶
SetDeniedCIDRs parses the given CIDR strings and replaces the operator-configured part of the denied networks; the built-in cloud metadata prefixes are always retained. It returns an error on the first invalid CIDR, leaving the previous value unchanged.
Types ¶
type CachingRoundTripper ¶
type CachingRoundTripper struct {
// contains filtered or unexported fields
}
CachingRoundTripper is a simple HTTP client cache for HTTP responses. It only caches GET requests (since for POST request caching, request bodies need to be cached as well), and only if the response is cacheable according to RFC 7234. It only works on expiration time and does not respect ETags headers. When the cache is full, the entries that expire first are removed to make room for new entries (since those are the first ones to be pruned any ways).
func NewCachingTransport ¶
func NewCachingTransport(underlyingTransport http.RoundTripper, responsesCacheSize int) *CachingRoundTripper
NewCachingTransport creates a new CachingHTTPTransport with the given underlying transport and cache size.
type StrictHTTPClient ¶
type StrictHTTPClient struct {
// contains filtered or unexported fields
}
func New ¶
func New(timeout time.Duration) *StrictHTTPClient
New creates a new HTTP client with the given timeout.
func NewWithCache ¶
func NewWithCache(timeout time.Duration) *StrictHTTPClient
NewWithCache creates a new HTTP client with the given timeout. It uses the DefaultCachingTransport as the underlying transport.
func NewWithTLSConfig ¶
func NewWithTLSConfig(timeout time.Duration, tlsConfig *tls.Config) *StrictHTTPClient
NewWithTLSConfig creates a new HTTP client with the given timeout and TLS configuration. It copies the http.DefaultTransport and sets the TLSClientConfig to the given tls.Config. As such, it can't be used in conjunction with the CachingRoundTripper.
Source Files