For a peer outside SWRP_TRUSTED_PROXIES, rproxy now reads each header name with _ as - and in any letter case. It removes the header when that name starts with X-Forwarded- or is Forwarded or X-Real-IP. Before, X_Forwarded_Ssl: on or X_Real_IP from a client connecting directly reached the app unchanged, and an app behind CGI or FastCGI reads them as the dash-spelt headers. A trusted peer's headers pass on as before; the trusted-peer test now sends X_Forwarded_Ssl too to show it.
SPEC.md "Passing a request to the app" gains one sentence.
The separate Del("X-Real-IP") is gone: the loop covers it. Forwarded is matched in the loop although ReverseProxy already drops its dash spelling, since the issue asks for it and it costs one comparison.
For a peer outside `SWRP_TRUSTED_PROXIES`, `rproxy` now reads each header name with `_` as `-` and in any letter case. It removes the header when that name starts with `X-Forwarded-` or is `Forwarded` or `X-Real-IP`. Before, `X_Forwarded_Ssl: on` or `X_Real_IP` from a client connecting directly reached the app unchanged, and an app behind CGI or FastCGI reads them as the dash-spelt headers. A trusted peer's headers pass on as before; the trusted-peer test now sends `X_Forwarded_Ssl` too to show it.
`SPEC.md` "Passing a request to the app" gains one sentence.
The separate `Del("X-Real-IP")` is gone: the loop covers it. `Forwarded` is matched in the loop although `ReverseProxy` already drops its dash spelling, since the issue asks for it and it costs one comparison.
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/334
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 08:02:00 +01:00
For a peer outside `SWRP_TRUSTED_PROXIES`, `rproxy` now reads each header name with `_` as `-` and in any letter case, and removes it when it starts with `X-Forwarded-` or is `Forwarded` or `X-Real-IP`. An app behind CGI or FastCGI reads `X_Forwarded_Ssl` as `HTTP_X_FORWARDED_SSL`, the same as `X-Forwarded-Ssl`, so a client connecting directly could still make it take a plain request for a secure one. A trusted peer's headers pass on unchanged. `SPEC.md` says so.
Model: opus-5-5
PASS: for a peer outside SWRP_TRUSTED_PROXIES, rproxy now removes forwarded headers spelt with underscores, as #334 asks.
Model: opus-5-5
PASS: for a peer outside `SWRP_TRUSTED_PROXIES`, `rproxy` now removes forwarded headers spelt with underscores, as https://git.eeqj.de/sneak/smallwebwaf/issues/334 asks.
Model: opus-5-5
clawbot
merged commit 6e370b346b into next2026-11-11 08:30:00 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
For a peer outside
SWRP_TRUSTED_PROXIES,rproxynow reads each header name with_as-and in any letter case. It removes the header when that name starts withX-Forwarded-or isForwardedorX-Real-IP. Before,X_Forwarded_Ssl: onorX_Real_IPfrom a client connecting directly reached the app unchanged, and an app behind CGI or FastCGI reads them as the dash-spelt headers. A trusted peer's headers pass on as before; the trusted-peer test now sendsX_Forwarded_Ssltoo to show it.SPEC.md"Passing a request to the app" gains one sentence.The separate
Del("X-Real-IP")is gone: the loop covers it.Forwardedis matched in the loop althoughReverseProxyalready drops its dash spelling, since the issue asks for it and it costs one comparison.Closes #334
Model: opus-5-5
PASS: for a peer outside
SWRP_TRUSTED_PROXIES,rproxynow removes forwarded headers spelt with underscores, as #334 asks.Model: opus-5-5