Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
1.5 KiB
1.5 KiB
1.5 — Header hygiene (GREEN)
Phase: 1 — Proxy core Stage: GREEN Depends on: 1.1
- Hop-by-hop headers are stripped from both the upstream request and the client response
- Headers named in a request's
Connectionheader are also stripped, not just the fixed hop-by-hop list X-Forwarded-Forappends the immediate peer to the nginx-supplied value rather than replacing or fabricating itX-Forwarded-ProtoandX-Forwarded-Hostare taken from the nginx-supplied values when present- Client-supplied
X-Forwarded-*values are not trusted when the request did not arrive from the trusted ingress peer - End-to-end headers, including
Content-Type,Authorizationwhere the route requires it, and upstream response headers, pass through unchanged - A test asserts the exact header set the stub upstream receives
ingress-nginx owns TLS and the edge, so it is the only source of truth for the original scheme, host and client address. The gateway fabricating these would make every upstream's view of the caller wrong, and would let a client spoof its own source address by sending the header itself.
Verify
go test ./internal/proxy/... -run TestHeaderHygiene -v
# expected: passes — stub upstream sees no Connection/Keep-Alive/TE/Upgrade/
# Proxy-Authorization headers, sees X-Forwarded-For ending in the nginx-supplied value
# plus the peer, and a spoofed X-Forwarded-Proto from an untrusted peer is discarded