mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-11-03 19:14:27 -05:00
micbar
4e7ebd4f8c
chi's ClientIPFrom* header middlewares trust the header from anyone who can
reach us. Pick the middleware per request instead: headers are only read
when the peer is a trusted proxy, everyone else gets their network address.
- PROXY_TRUSTED_PROXIES, defaults to loopback and private ranges
- PROXY_CLIENT_IP_HEADER, defaults to X-Forwarded-For, e.g. CF-Connecting-IP
- drop the strategy setting and xff_trusted_hops
- pass the client address to the services in X-Forwarded-For instead of
X-Client-Ip, reva reads it e.g. for OCM
- same check in collaboration, traefik routes to it directly
- OC_TRUSTED_PROXIES and OC_CLIENT_IP_HEADER set both services
- the other services only drop RealIP, none of them reads the address
Taken from #3864 and https://github.com/opencloud-eu/opencloud/pull/3464#issuecomment-6494799883
# Conflicts:
# services/proxy/README.md
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/opencloud-eu/opencloud/pkg/cors"
|
|
|
|
rscors "github.com/rs/cors"
|
|
)
|
|
|
|
// NoCache writes required cache headers to all requests.
|
|
func NoCache(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate, value")
|
|
w.Header().Set("Expires", "Thu, 01 Jan 1970 00:00:00 GMT")
|
|
w.Header().Set("Last-Modified", time.Now().UTC().Format(http.TimeFormat))
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// Cors writes required cors headers to all requests.
|
|
func Cors(opts ...cors.Option) func(http.Handler) http.Handler {
|
|
options := cors.NewOptions(opts...)
|
|
logger := options.Logger
|
|
logger.Debug().
|
|
Str("allowed_origins", strings.Join(options.AllowedOrigins, ", ")).
|
|
Str("allowed_methods", strings.Join(options.AllowedMethods, ", ")).
|
|
Str("allowed_headers", strings.Join(options.AllowedHeaders, ", ")).
|
|
Bool("allow_credentials", options.AllowCredentials).
|
|
Msg("setup cors middleware")
|
|
c := rscors.New(rscors.Options{
|
|
AllowedOrigins: options.AllowedOrigins,
|
|
AllowedMethods: options.AllowedMethods,
|
|
AllowedHeaders: options.AllowedHeaders,
|
|
AllowCredentials: options.AllowCredentials,
|
|
})
|
|
return c.Handler
|
|
}
|