ProxyHeaders processes proxy headers for trusted proxies.
(config ProxyConfiguration)
| 83 | |
| 84 | // ProxyHeaders processes proxy headers for trusted proxies. |
| 85 | func ProxyHeaders(config ProxyConfiguration) MiddlewareFunc { |
| 86 | return func(next http.Handler) http.Handler { |
| 87 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 88 | ctx := r.Context() |
| 89 | remoteIP, _, err := net.SplitHostPort(r.RemoteAddr) |
| 90 | if err != nil { |
| 91 | // The *http.Server should have set r.RemoteAddr to "IP:port". |
| 92 | panic(fmt.Errorf("invalid RemoteAddr %q in *http.Request: %w", r.RemoteAddr, err)) |
| 93 | } |
| 94 | if config.trustedIP(net.ParseIP(remoteIP)) { |
| 95 | // We trust the proxy, so we parse the headers if present. |
| 96 | forwardedFor, forwardedScheme, forwardedHost := parseForwardedHeaders(r.Header) |
| 97 | if forwardedFor != "" { |
| 98 | r.Header.Set(headerXRealIP, strings.TrimSpace(strings.Split(forwardedFor, ",")[0])) |
| 99 | } |
| 100 | if forwardedScheme != "" { |
| 101 | r.URL.Scheme = forwardedScheme |
| 102 | } |
| 103 | if forwardedHost != "" { |
| 104 | r.URL.Host = forwardedHost |
| 105 | } |
| 106 | if cert, ok, err := mtls.FromProxyHeaders(r.Header); err != nil { |
| 107 | log.FromContext(ctx).WithError(err).Warn("Failed to parse client certificate from proxy headers") |
| 108 | } else if ok { |
| 109 | ctx = mtls.NewContextWithClientCertificate(ctx, cert) |
| 110 | } |
| 111 | } else { |
| 112 | // We don't trust the proxy, remove its headers. |
| 113 | for _, header := range proxyHeaders { |
| 114 | r.Header.Del(header) |
| 115 | } |
| 116 | r.Header.Set(headerXRealIP, remoteIP) |
| 117 | } |
| 118 | next.ServeHTTP(w, r.WithContext(ctx)) |
| 119 | }) |
| 120 | } |
| 121 | } |
| 122 | |
| 123 | func parseForwardedHeaders(h http.Header) (forwardedFor, forwardedScheme, forwardedHost string) { |
| 124 | if xForwardedFor := h.Get(headerXForwardedFor); xForwardedFor != "" { |