Method proxyRequestToLocalAPI

client/web/web.go:1278–1319

proxyRequestToLocalAPI proxies the web API request to the localapi. The web API request path is expected to exactly match a localapi path, with prefix /api/local/ rather than /localapi/.

(w http.ResponseWriter, r *http.Request)

// The web API request path is expected to exactly match a localapi path,
// with prefix /api/local/ rather than /localapi/.
func (s *Server) proxyRequestToLocalAPI(w http.ResponseWriter, r *http.Request) {
	path := strings.TrimPrefix(r.URL.Path, "/api/local")
	if r.URL.Path == path { // missing prefix
		http.Error(w, "invalid request", http.StatusBadRequest)
		return
	}

	switch path {
	case "/v0/logout":
		if !s.getPeer(r.Context()).canEdit(capFeatureAccount) {
			http.Error(w, "not allowed", http.StatusUnauthorized)
			return
		}
	case "/v0/update/check":
		if r.Method == httpm.POST && !s.getPeer(r.Context()).canEdit(capFeatureAccount) {
			http.Error(w, "not allowed", http.StatusUnauthorized)
			return
		}
	}

	localAPIURL := "http://" + apitype.LocalAPIHost + "/localapi" + path
	req, err := http.NewRequestWithContext(r.Context(), r.Method, localAPIURL, r.Body)
	if err != nil {
		http.Error(w, "failed to construct request", http.StatusInternalServerError)
		return
	}

	// Make request to tailscaled localapi.
	resp, err := s.lc.DoLocalRequest(req)
	if err != nil {
		http.Error(w, err.Error(), resp.StatusCode)
		return
	}
	defer resp.Body.Close()

	// Send response back to web frontend.
	w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
	w.WriteHeader(resp.StatusCode)
	if _, err := io.Copy(w, resp.Body); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}
}

// enforcePrefix returns a HandlerFunc that enforces a given path prefix is used in requests,
// then strips it before invoking h.