Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http/httputil: add docs about X-Forwarded-For in ReverseProxy #36672

Closed
wants to merge 2 commits into from
Closed

net/http/httputil: add docs about X-Forwarded-For in ReverseProxy #36672

wants to merge 2 commits into from

Conversation

dunglas
Copy link
Contributor

@dunglas dunglas commented Jan 21, 2020 •
edited

ReverseProxy automatically sets the X-Forwarded-For header, if the request
already contains a X-Forwarded-For header, the value of the client IP is
appended to the existing header value.
This behavior isn't documented anywhere, and can lead to IP spoofing
security issues is the client is untrusted (the most common situation).
This PR documents this behavior.

For future versions, I proposed #36678 that implements a more secure
default behavior and adds support for other forwarded headers.

@googlebot googlebot added the cla: yes Used by googlebot to label PRs as having a valid CLA. The text of this label should not change. label Jan 21, 2020
@gopherbot
Copy link

This PR (HEAD: 2b1023f) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/go/+/215617 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@gopherbot
Copy link

Message from Gobot Gobot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
Within the next week or so, a maintainer will review your change and provide
feedback. See https://golang.org/doc/contribute.html#review for more info and
tips to get your patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11, it means that this CL will be reviewed as part of the next development
cycle. See https://golang.org/s/release for more details.

Please don’t reply on this GitHub thread. Visit golang.org/cl/215617.
After addressing review feedback, remember to publish your drafts!

@dunglas dunglas mentioned this pull request Jan 21, 2020
Open
@gopherbot
Copy link

Message from Brad Fitzpatrick:

Patch Set 2:

(4 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/215617.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link

This PR (HEAD: fd0bd29) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/go/+/215617 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

gopherbot pushed a commit that referenced this pull request Jan 21, 2020
@dunglas @bradfitz
net/http/httputil: add docs about X-Forwarded-For in ReverseProxy
88ed322 
ReverseProxy automatically sets the X-Forwarded-For header, if the request
already contains a X-Forwarded-For header, the value of the client IP is
appended to the existing header value.
This behavior isn't documented anywhere, and can lead to IP spoofing
security issues is the client is untrusted (the most common situation).
This PR documents this behavior.

For future versions, I proposed #36678 that implements a more secure
default behavior and adds support for other forwarded headers.

Change-Id: Ief14f5063caebfccb87714f54cffa927c714e5fd
GitHub-Last-Rev: fd0bd29
GitHub-Pull-Request: #36672
Reviewed-on: https://go-review.googlesource.com/c/go/+/215617
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
@gopherbot
Copy link

This PR is being closed because golang.org/cl/215617 has been merged.

@gopherbot gopherbot closed this Jan 21, 2020
@dunglas dunglas mentioned this pull request Jan 6, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
cla: yes Used by googlebot to label PRs as having a valid CLA. The text of this label should not change.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@dunglas @gopherbot @googlebot