net/http/httputil: add support for X-Forwarded-Proto, X-Forwarded-Host and an option to not trust forwarded headers in ReverseProxy

Author: dunglas

src/net/http/httputil/reverseproxy.go

@@ -76,6 +76,16 @@ type ReverseProxy struct {
 	// If nil, the default is to log the provided error and return
 	// a 502 Status Bad Gateway response.
 	ErrorHandler func(http.ResponseWriter, *http.Request, error)
+
+	// TrustForwardedHeaders specifies if X-Forwarded-For,
+	// X-Forwarded-Proto and X-Forwarded-Host headers comming from
+	// the previous proxy must be trusted or not.
+	// If true, existing values of X-Forwarded-Proto and
+	// X-Forwarded-Host will be preserved, and the current client IP
+	// will be appended to the list in X-Forwarded-For.
+	// If false, values of these headers will be set regardless of
+	// any existing value.
+	TrustForwardedHeaders bool
 }
 
 // A BufferPool is an interface for getting and returning temporary
@@ -236,6 +246,23 @@ func (p *ReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		outreq.Header.Set("Upgrade", reqUpType)
 	}
 
+	if _, ok := outreq.Header["X-Forwarded-Proto"]; !ok || !p.TrustForwardedHeaders {
+		proto := "https"
+		if req.TLS == nil {
+			proto = "http"
+		}
+
+		outreq.Header.Set("X-Forwarded-Proto", proto)
+	}
+
+	if _, ok := outreq.Header["X-Forwarded-Host"]; !ok || !p.TrustForwardedHeaders {
+		outreq.Header.Set("X-Forwarded-Host", outreq.Host)
+	}
+
+	if !p.TrustForwardedHeaders {
+		outreq.Header.Del("X-Forwarded-For")
+	}
+
 	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
 		// If we aren't the first proxy retain prior
 		// X-Forwarded-For information as a comma+space

src/net/http/httputil/reverseproxy_test.go

@@ -236,8 +236,61 @@ func TestReverseProxyStripHeadersPresentInConnection(t *testing.T) {
 	}
 }
 
+func TestDontTrustForwardedHeaders(t *testing.T) {
+	const prevForwardedFor = "client ip"
+	const prevForwardedProto = "https"
+	const prevForwardedHost = "example.com"
+	const backendResponse = "I am the backend"
+	const backendStatus = 404
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("X-Forwarded-For") == "" {
+			t.Errorf("didn't get X-Forwarded-For header")
+		}
+		if strings.Contains(r.Header.Get("X-Forwarded-For"), prevForwardedFor) {
+			t.Errorf("X-Forwarded-For contains prior data")
+		}
+		if strings.Contains(r.Header.Get("X-Forwarded-Proto"), prevForwardedProto) {
+			t.Errorf("X-Forwarded-Proto contains prior data")
+		}
+		if strings.Contains(r.Header.Get("X-Forwarded-Host"), prevForwardedHost) {
+			t.Errorf("X-Forwarded-Host contains prior data")
+		}
+		w.WriteHeader(backendStatus)
+		w.Write([]byte(backendResponse))
+	}))
+	defer backend.Close()
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxyHandler := NewSingleHostReverseProxy(backendURL)
+	frontend := httptest.NewServer(proxyHandler)
+	defer frontend.Close()
+
+	getReq, _ := http.NewRequest("GET", frontend.URL, nil)
+	getReq.Host = "some-name"
+	getReq.Header.Set("Connection", "close")
+	getReq.Header.Set("X-Forwarded-For", prevForwardedFor)
+	getReq.Header.Set("X-Forwarded-Proto", prevForwardedProto)
+	getReq.Header.Set("X-Forwarded-Host", prevForwardedHost)
+	getReq.Close = true
+	res, err := frontend.Client().Do(getReq)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if g, e := res.StatusCode, backendStatus; g != e {
+		t.Errorf("got res.StatusCode %d; expected %d", g, e)
+	}
+	bodyBytes, _ := ioutil.ReadAll(res.Body)
+	if g, e := string(bodyBytes), backendResponse; g != e {
+		t.Errorf("got body %q; expected %q", g, e)
+	}
+}
+
 func TestXForwardedFor(t *testing.T) {
 	const prevForwardedFor = "client ip"
+	const prevForwardedProto = "https"
+	const prevForwardedHost = "example.com"
 	const backendResponse = "I am the backend"
 	const backendStatus = 404
 	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -247,6 +300,12 @@ func TestXForwardedFor(t *testing.T) {
 		if !strings.Contains(r.Header.Get("X-Forwarded-For"), prevForwardedFor) {
 			t.Errorf("X-Forwarded-For didn't contain prior data")
 		}
+		if !strings.Contains(r.Header.Get("X-Forwarded-Proto"), prevForwardedProto) {
+			t.Errorf("X-Forwarded-Proto didn't contain prior data")
+		}
+		if !strings.Contains(r.Header.Get("X-Forwarded-Host"), prevForwardedHost) {
+			t.Errorf("X-Forwarded-Host didn't contain prior data")
+		}
 		w.WriteHeader(backendStatus)
 		w.Write([]byte(backendResponse))
 	}))
@@ -256,13 +315,16 @@ func TestXForwardedFor(t *testing.T) {
 		t.Fatal(err)
 	}
 	proxyHandler := NewSingleHostReverseProxy(backendURL)
+	proxyHandler.TrustForwardedHeaders = true
 	frontend := httptest.NewServer(proxyHandler)
 	defer frontend.Close()
 
 	getReq, _ := http.NewRequest("GET", frontend.URL, nil)
 	getReq.Host = "some-name"
 	getReq.Header.Set("Connection", "close")
 	getReq.Header.Set("X-Forwarded-For", prevForwardedFor)
+	getReq.Header.Set("X-Forwarded-Proto", prevForwardedProto)
+	getReq.Header.Set("X-Forwarded-Host", prevForwardedHost)
 	getReq.Close = true
 	res, err := frontend.Client().Do(getReq)
 	if err != nil {