Add reverse proxy setting #331
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
loshz
requested changes
Dec 17, 2019
Co-Authored-By: Dan Bond <[email protected]>
|
The CHANGELOG has been updated and minor change requested was added. Anything else needing done for this PR? |
|
@JoelSpeed @steakunderscore can you also review this please. |
JoelSpeed
approved these changes
Jan 14, 2020
ploxiln
added a commit
to ploxiln/oauth2_proxy
that referenced
this pull request
Feb 19, 2020
this PR inspired by oauth2-proxy/oauth2-proxy#331 by Martin Campbell <[email protected]> this option name inspired by the python Tornado framework HTTPServer
ploxiln
added a commit
to ploxiln/oauth2_proxy
that referenced
this pull request
Feb 19, 2020
this PR inspired by oauth2-proxy/oauth2-proxy#331 by Martin Campbell <[email protected]> this option name inspired by the python Tornado framework HTTPServer
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Adds a new
ReverseProxyoption that controls whether the application accepts HTTP headers that can be set by a reverse proxy to indicate the real user etc.Currently, this only affects whether the logger respects the
X-Real-Ipheader. If set, this will be used if present. If not set, this will be ignored, even with a value as a malicious user could be trying to log a false IP address.In the future this could also control other common headers, e.g.
X-Forwarded-Foretc.Big discussion point is that this is a BREAKING CHANGE for users currently behind a reverse proxy. The default value has been deliberately set to
falseas a user who runs this with a minimal configuration (without fully reading docs) should be left with a secure configuration by default. If being hosted behind a reverse proxy then this flag needs to be enabled.We should consider:
trueto allow for a period of bedding in then change tofalseafter a suitable time? If so, how long?Motivation and Context
Corrects the security issue by always accepting the
X-Real-Ipheader (described in #321).How Has This Been Tested?
Quick and dirty test with curl - should be checked by others.
Checklist:
Documentation has been updated but left the changelog until discussion has been had around best way to implement (if at all).