net/http/httputil: add support for X-Forwarded-Proto, X-Forwarded-Host and an option to not trust forwarded headers in ReverseProxy

src/net/http/httputil/reverseproxy.go

@@ -24,22 +24,37 @@ import (
 	"golang.org/x/net/http/httpguts"
 )
 
+type ForwardedHeaderBehavior uint8
+
+const (
+	// Overwrite existing X-Forwarded-For, X-Forwarded-Proto
+	// and X-Forwarded-Host HTTP headers with values extracted
+	// from the current connection with the client.
+	// As a special case, headers explicitly set to nil
+	// are never modified.
+	ForwardedHeaderOverwrite ForwardedHeaderBehavior = iota
+
+	// Add client IP to the existing IPs in X-Forwarded-For.
+	// Preserve X-Forwarded-Proto and X-Forwarded-Host if set.
+	// Ensure that the previous proxies in the chain are trusted
+	// As a special case, headers explicitly set to nil
+	// are never modified.
+	// when using this value, or it will lead to security issues.
+	ForwardedHeaderAdd
+
+	// Preserve all existing forwarded HTTP headers.
+	// Ensure that the previous proxies in the chain are trusted
+	// when using this value, or it will lead to security issues.
+	ForwardedHeaderPreserve
+)
+
 // ReverseProxy is an HTTP Handler that takes an incoming request and
 // sends it to another server, proxying the response back to the
 // client.
 //
 // ReverseProxy by default sets the client IP as the value of the
-// X-Forwarded-For header.
-//
-// If an X-Forwarded-For header already exists, the client IP is
-// appended to the existing values. As a special case, if the header
-// exists in the Request.Header map but has a nil value (such as when
-// set by the Director func), the X-Forwarded-For header is
-// not modified.
-//
-// To prevent IP spoofing, be sure to delete any pre-existing
-// X-Forwarded-For header coming from the client or
-// an untrusted proxy.
+// X-Forwarded-For header. To control this behavior,
+// set the ForwardedHeaderBehavior field.
 type ReverseProxy struct {
 	// Director must be a function which modifies
 	// the request into a new request to be sent
@@ -92,6 +107,11 @@ type ReverseProxy struct {
 	// If nil, the default is to log the provided error and return
 	// a 502 Status Bad Gateway response.
 	ErrorHandler func(http.ResponseWriter, *http.Request, error)
+
+	// OverwriteForwardedHeaders specifies how to deal with the
+	// X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host
+	// headers.
+	ForwardedHeaderBehavior ForwardedHeaderBehavior
 }
 
 // A BufferPool is an interface for getting and returning temporary
@@ -282,17 +302,38 @@ func (p *ReverseProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		outreq.Header.Set("Upgrade", reqUpType)
 	}
 
-	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
-		// If we aren't the first proxy retain prior
-		// X-Forwarded-For information as a comma+space
-		// separated list and fold multiple headers into one.
-		prior, ok := outreq.Header["X-Forwarded-For"]
-		omit := ok && prior == nil // Issue 38079: nil now means don't populate the header
-		if len(prior) > 0 {
-			clientIP = strings.Join(prior, ", ") + ", " + clientIP
+	if p.ForwardedHeaderBehavior != ForwardedHeaderPreserve {
+		if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+			// If we aren't the first proxy retain prior
+			// X-Forwarded-For information as a comma+space
+			// separated list and fold multiple headers into one.
+			prior, ok := outreq.Header["X-Forwarded-For"]
+			omit := ok && prior == nil // Issue 38079: nil now means don't populate the header
+			log.Printf("%#v %#v", prior, omit)
+			if p.ForwardedHeaderBehavior == ForwardedHeaderAdd && len(prior) > 0 {
+				clientIP = strings.Join(prior, ", ") + ", " + clientIP
+			}
+			if !omit {
+				outreq.Header.Set("X-Forwarded-For", clientIP)
+			}
 		}
-		if !omit {
-			outreq.Header.Set("X-Forwarded-For", clientIP)
+
+		if p.ForwardedHeaderBehavior == ForwardedHeaderOverwrite {
+			prior, ok := outreq.Header["X-Forwarded-Host"]
+			omit := ok && prior == nil // nil means don't populate the header
+			if !omit {
+				outreq.Header.Set("X-Forwarded-Host", req.Host)
+			}
+
+			prior, ok = outreq.Header["X-Forwarded-Proto"]
+			omit = ok && prior == nil // nil means don't populate the header
+			if !omit {
+				if req.TLS == nil {
+					outreq.Header.Set("X-Forwarded-Proto", "http")
+				} else {
+					outreq.Header.Set("X-Forwarded-Proto", "https")
+				}
+			}
 		}
 	}