Documentation
¶
Overview ¶
Package httpguard is the access check in front of every route both servers expose: /mcp, /update and /reindex, the UI and the JSON routes it reads, and /ws.
Why it exists: both servers used to listen on every interface with no credential and no Origin or Host check. On a workstation that let any web page the developer opened rebind its own hostname to 127.0.0.1 and drive the server from the browser — index a file with update_code_graph, read it back with get_graph_node. In a cluster it let any pod read every map, including catalog maps that are only encrypted at rest.
Three checks, cheapest first, every one skipped for /healthz so probes need nothing:
- Host. When the listener is loopback, the Host header must name loopback (or an -allowed-hosts entry). This is what defeats DNS rebinding: the rebound page still sends its own hostname.
- Origin. A browser request from another origin is refused unless it is listed in -allowed-origins. Non-browser clients send no Origin and pass.
- Token. With a token configured, every request needs "Authorization: Bearer <token>", or the cookie the UI gets from /ui?token=<token> — a browser cannot attach a header to a page load or a WebSocket.
Index ¶
Constants ¶
const CookieName = "xray_memory_token"
CookieName carries the token for the browser UI.
const MinTokenLen = 16
MinTokenLen refuses a token short enough to guess.
Variables ¶
This section is empty.
Functions ¶
func IsLoopback ¶
IsLoopback reports whether addr binds only the loopback interface. ":8084" and "0.0.0.0:8084" are not: they listen on every interface.
Types ¶
type Config ¶
type Config struct {
// Addr is the listen address. A loopback one ("127.0.0.1:8084",
// "localhost:8084", "[::1]:8084") turns on the Host check.
Addr string
// Token, when set, is required on every request but /healthz.
Token string
// AllowedHosts are further Host names (no port) to accept. Any entry turns
// the Host check on, whatever Addr is.
AllowedHosts []string
// AllowedOrigins are further browser origins (scheme://host[:port]) to
// accept beside the server's own.
AllowedOrigins []string
}
Config is what the guard enforces. The zero value checks Origin only.
Source Files