From the review of #330 (#330 (comment)), which makes rproxy remove every X-Forwarded- header from a peer outside SWRP_TRUSTED_PROXIES.
What is wrong: a peer outside SWRP_TRUSTED_PROXIES can still send the same headers spelt with underscores, such as X_Forwarded_Ssl: on or X_Real_IP. They reach the app unchanged. A PHP app behind a server that maps headers to CGI variables reads X_Forwarded_Ssl and X-Forwarded-Ssl as the same HTTP_X_FORWARDED_SSL, so it can take a plain request for a secure one, as #325 describes.
Definition of done, one PR into next, after #330 lands:
For a peer outside SWRP_TRUSTED_PROXIES, a header is removed when its name, read with each _ as - and in any letter case, starts with X-Forwarded- or is Forwarded or X-Real-IP. A trusted peer's headers pass on as now.
SPEC.md "Passing a request to the app" says so in one sentence.
A test sends X_Forwarded_Ssl, X_Forwarded_Proto and X_Real_IP from an untrusted peer and finds none at the app.
Package: internal/rproxy (client.go), whose doc says it is the reverse proxy. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
From the review of https://git.eeqj.de/sneak/smallwebwaf/pulls/330 (https://git.eeqj.de/sneak/smallwebwaf/pulls/330#issuecomment-177631), which makes `rproxy` remove every `X-Forwarded-` header from a peer outside `SWRP_TRUSTED_PROXIES`.
**What is wrong:** a peer outside `SWRP_TRUSTED_PROXIES` can still send the same headers spelt with underscores, such as `X_Forwarded_Ssl: on` or `X_Real_IP`. They reach the app unchanged. A PHP app behind a server that maps headers to CGI variables reads `X_Forwarded_Ssl` and `X-Forwarded-Ssl` as the same `HTTP_X_FORWARDED_SSL`, so it can take a plain request for a secure one, as https://git.eeqj.de/sneak/smallwebwaf/issues/325 describes.
**Definition of done**, one PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/pulls/330 lands:
- For a peer outside `SWRP_TRUSTED_PROXIES`, a header is removed when its name, read with each `_` as `-` and in any letter case, starts with `X-Forwarded-` or is `Forwarded` or `X-Real-IP`. A trusted peer's headers pass on as now.
- `SPEC.md` "Passing a request to the app" says so in one sentence.
- A test sends `X_Forwarded_Ssl`, `X_Forwarded_Proto` and `X_Real_IP` from an untrusted peer and finds none at the app.
Package: `internal/rproxy` (`client.go`), whose doc says it is the reverse proxy. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 06:28:31 +01:00
Built in #341: for an untrusted peer, rproxy reads header names with _ as - before removing forwarded headers; SPEC.md and the tests cover it.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/341: for an untrusted peer, `rproxy` reads header names with `_` as `-` before removing forwarded headers; `SPEC.md` and the tests cover it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From the review of #330 (#330 (comment)), which makes
rproxyremove everyX-Forwarded-header from a peer outsideSWRP_TRUSTED_PROXIES.What is wrong: a peer outside
SWRP_TRUSTED_PROXIEScan still send the same headers spelt with underscores, such asX_Forwarded_Ssl: onorX_Real_IP. They reach the app unchanged. A PHP app behind a server that maps headers to CGI variables readsX_Forwarded_SslandX-Forwarded-Sslas the sameHTTP_X_FORWARDED_SSL, so it can take a plain request for a secure one, as #325 describes.Definition of done, one PR into
next, after #330 lands:SWRP_TRUSTED_PROXIES, a header is removed when its name, read with each_as-and in any letter case, starts withX-Forwarded-or isForwardedorX-Real-IP. A trusted peer's headers pass on as now.SPEC.md"Passing a request to the app" says so in one sentence.X_Forwarded_Ssl,X_Forwarded_ProtoandX_Real_IPfrom an untrusted peer and finds none at the app.Package:
internal/rproxy(client.go), whose doc says it is the reverse proxy. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5
Built in #341: for an untrusted peer,
rproxyreads header names with_as-before removing forwarded headers;SPEC.mdand the tests cover it.Model: opus-5-5