From f3ce73447cec0941a3bded1384f45c1ee011ff95 Mon Sep 17 00:00:00 2001 From: fang Date: Fri, 16 Feb 2024 20:20:57 +0100 Subject: [PATCH] eyre: respect host from Forwarded header, if set Eyre already looks at the Forwarded header for the original requester's IP address, and the security level of the connection. Some proxies may modify the original Host header, but still provide the original in the Forwarded header. So, if present, we respect that. --- pkg/arvo/sys/vane/eyre.hoon | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/pkg/arvo/sys/vane/eyre.hoon b/pkg/arvo/sys/vane/eyre.hoon index 60d24c3a90..172c1ffc7e 100644 --- a/pkg/arvo/sys/vane/eyre.hoon +++ b/pkg/arvo/sys/vane/eyre.hoon @@ -798,14 +798,15 @@ =* headers header-list.request :: for requests from localhost, respect the "forwarded" header :: - =/ [secure=? =^address] - =* same [secure address] + =/ [secure=? host=(unit @t) =^address] + =/ host=(unit @t) (get-header:http 'host' headers) + =* same [secure host address] ?. =([%ipv4 .127.0.0.1] address) same ?~ forwards=(forwarded-params headers) same - :- (fall (forwarded-secure u.forwards) secure) + :+ (fall (forwarded-secure u.forwards) secure) + (clap (forwarded-host u.forwards) host head) (fall (forwarded-for u.forwards) address) :: - =/ host (get-header:http 'host' headers) =/ [=action suburl=@t] (get-action-for-binding host url.request) :: @@ -3241,6 +3242,12 @@ %https `& == :: +++ forwarded-host + |= forwards=(list (map @t @t)) + ^- (unit @t) + ?. ?=(^ forwards) ~ + (~(get by i.forwards) 'host') +:: ++ parse-request-line |= url=@t ^- [[ext=(unit @ta) site=(list @t)] args=(list [key=@t value=@t])]