Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
28 lines
1.5 KiB
Markdown
28 lines
1.5 KiB
Markdown
# 1.5 — Header hygiene (GREEN)
|
|
|
|
Phase: 1 — Proxy core
|
|
Stage: GREEN
|
|
Depends on: [1.1](1.1-reverse-proxy.md)
|
|
|
|
- [ ] Hop-by-hop headers are stripped from both the upstream request and the client response
|
|
- [ ] Headers named in a request's `Connection` header are also stripped, not just the fixed hop-by-hop list
|
|
- [ ] `X-Forwarded-For` appends the immediate peer to the nginx-supplied value rather than replacing or fabricating it
|
|
- [ ] `X-Forwarded-Proto` and `X-Forwarded-Host` are taken from the nginx-supplied values when present
|
|
- [ ] Client-supplied `X-Forwarded-*` values are not trusted when the request did not arrive from the trusted ingress peer
|
|
- [ ] End-to-end headers, including `Content-Type`, `Authorization` where the route requires it, and upstream response headers, pass through unchanged
|
|
- [ ] A test asserts the exact header set the stub upstream receives
|
|
|
|
ingress-nginx owns TLS and the edge, so it is the only source of truth for the
|
|
original scheme, host and client address. The gateway fabricating these would make
|
|
every upstream's view of the caller wrong, and would let a client spoof its own
|
|
source address by sending the header itself.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
go test ./internal/proxy/... -run TestHeaderHygiene -v
|
|
# expected: passes — stub upstream sees no Connection/Keep-Alive/TE/Upgrade/
|
|
# Proxy-Authorization headers, sees X-Forwarded-For ending in the nginx-supplied value
|
|
# plus the peer, and a spoofed X-Forwarded-Proto from an untrusted peer is discarded
|
|
```
|