28 lines
1.5 KiB
Markdown
28 lines
1.5 KiB
Markdown
|
# 1.5 — Header hygiene (GREEN)
|
||
|
|
|
||
|
|
Phase: 1 — Proxy core
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [1.1](1.1-reverse-proxy.md)
|
||
|
|
|
||
|
|
- [ ] Hop-by-hop headers are stripped from both the upstream request and the client response
|
||
|
|
- [ ] Headers named in a request's `Connection` header are also stripped, not just the fixed hop-by-hop list
|
||
|
|
- [ ] `X-Forwarded-For` appends the immediate peer to the nginx-supplied value rather than replacing or fabricating it
|
||
|
|
- [ ] `X-Forwarded-Proto` and `X-Forwarded-Host` are taken from the nginx-supplied values when present
|
||
|
|
- [ ] Client-supplied `X-Forwarded-*` values are not trusted when the request did not arrive from the trusted ingress peer
|
||
|
|
- [ ] End-to-end headers, including `Content-Type`, `Authorization` where the route requires it, and upstream response headers, pass through unchanged
|
||
|
|
- [ ] A test asserts the exact header set the stub upstream receives
|
||
|
|
|
||
|
|
ingress-nginx owns TLS and the edge, so it is the only source of truth for the
|
||
|
|
original scheme, host and client address. The gateway fabricating these would make
|
||
|
|
every upstream's view of the caller wrong, and would let a client spoof its own
|
||
|
|
source address by sending the header itself.
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
go test ./internal/proxy/... -run TestHeaderHygiene -v
|
||
|
|
# expected: passes — stub upstream sees no Connection/Keep-Alive/TE/Upgrade/
|
||
|
|
# Proxy-Authorization headers, sees X-Forwarded-For ending in the nginx-supplied value
|
||
|
|
# plus the peer, and a spoofed X-Forwarded-Proto from an untrusted peer is discarded
|
||
|
|
```
|