[Catalyst-dev] X-Forwarded-* headers patches
Dave Rolsky
autarch at urth.org
Sun Jun 17 06:45:41 GMT 2007
Per discussion on the catalyst list, this patch implements handling for a bunch
of different X-Forwarded headers in a centralized spot, so that all engines
benefit. I've also included patches for the Apache and SCGI engines to remove
the proxy-related code they had implemented internally.
Engines that didn't implement any proxy handling will magically get this
handling added when the user upgrades to a version of Catalyst-Runtime with
this code in it, and I _think_ that old versions of the engines should still
just work.
Here's a summary from the docs:
=over 4
=item * X-Forwarded-For
The IP address in C<< $c->req->address >> is set to the user's real IP
address, as read from the X-Forwarded-For header.
=item * X-Forwarded-Host
The host value for C<< $c->req->base >> and C<< $c->req->uri >> is set
to the real host, as read from the X-Forwarded-Host header. The value
of C<< $c->req->hostname >> is also adjusted accordingly.
=item * X-Forwarded-Port
The port value for C<< $c->req->base >> and C<< $c->req->uri >> is set
to the real port, as read from the X-Forwarded-Port header.
=item * X-Forwarded-Path
If this is set, the value of the X-Forwarded-Path header is
I<prepended> to the path value of C<< $c->req->base >> and C<<
$c->req->uri >>.
=item * X-Forwarded-Is-SSL
If this is set, the scheme value of C<< $c->req->base >> and C<<
$c->req->uri >> is set to "https". Additional, C<< $c->req->protocol
>> is also set to "https", and C<< $c->req->secure >> is set to a true
value.
=back
-dave
/*===================================================
VegGuide.Org www.BookIRead.com
Your guide to all that's veg. My book blog
===================================================*/
-------------- next part --------------
Index: Catalyst-Engine-Apache/t/live_engine_request_headers.t
===================================================================
--- Catalyst-Engine-Apache/t/live_engine_request_headers.t (revision 6466)
+++ Catalyst-Engine-Apache/t/live_engine_request_headers.t (working copy)
@@ -6,7 +6,7 @@
use FindBin;
use lib "$FindBin::Bin/lib";
-use Test::More tests => 17;
+use Test::More tests => 27;
use Catalyst::Test 'TestApp';
use Catalyst::Request;
@@ -17,12 +17,18 @@
{
my $creq;
- my $request = GET( 'http://localhost/dump/request',
- 'User-Agent' => 'MyAgen/1.0',
- 'X-Whats-Cool' => 'Catalyst',
- 'X-Multiple' => [ 1 .. 5 ],
- 'X-Forwarded-Host' => 'frontend.server.com',
- 'X-Forwarded-For' => '192.168.1.1, 1.2.3.4',
+ my $request = GET(
+ 'http://localhost/dump/request',
+ 'User-Agent' => 'MyAgen/1.0',
+ 'X-Whats-Cool' => 'Catalyst',
+ 'X-Multiple' => [ 1 .. 5 ],
+ 'X-Forwarded-Host' => 'frontend.server.com',
+ 'X-Forwarded-For' => '192.168.1.1, 1.2.3.4',
+ # Trailing slash is intentional - tests that we don't generate
+ # paths with doubled slashes
+ 'X-Forwarded-Path' => '/prefix/',
+ 'X-Forwarded-Port' => '12345',
+ 'X-Forwarded-Is-SSL' => 1,
);
ok( my $response = request($request), 'Request' );
@@ -50,11 +56,21 @@
SKIP:
{
if ( $ENV{CATALYST_SERVER} && $ENV{CATALYST_SERVER} !~ /127.0.0.1|localhost/ ) {
- skip "Using remote server", 2;
+ skip "Using remote server", 12;
}
- is( $creq->base->host, 'frontend.server.com', 'Catalyst::Request proxied base' );
- is( $creq->address, '1.2.3.4', 'Catalyst::Request proxied address' );
+ is( $creq->address, '1.2.3.4', 'X-Forwarded-For header => address()' );
+ is( $creq->hostname, 'frontend.server.com', 'X-Forwarded-Host header => hostname()' );
+ is( $creq->base->host, 'frontend.server.com', 'X-Forwarded-Host => base()->host()' );
+ is( $creq->uri->host, 'frontend.server.com', 'X-Forwarded-Host => uri()->host()' );
+ is( $creq->base->path, '/prefix/', 'X-Forwarded-Path => base()->path()' );
+ is( $creq->uri->path, '/prefix/dump/request', 'X-Forwarded-Path => uri()->path()' );
+ is( $creq->base->port, 12345, 'X-Forwarded-Port => base()->port()' );
+ is( $creq->uri->port, 12345, 'X-Forwarded-Port => uri()->port()' );
+ is( $creq->protocol, 'https', 'X-Forwarded-Is-Secure => protocol()' );
+ ok( $creq->secure, 'X-Forwarded-Is-Secure => secure()' );
+ is( $creq->base->scheme, 'https', 'X-Forwarded-Is-Secure => base()->scheme()' );
+ is( $creq->uri->scheme, 'https', 'X-Forwarded-Is-Secure => uri()->scheme()' );
}
SKIP:
Index: Catalyst-Engine-Apache/lib/Catalyst/Engine/Apache.pm
===================================================================
--- Catalyst-Engine-Apache/lib/Catalyst/Engine/Apache.pm (revision 6466)
+++ Catalyst-Engine-Apache/lib/Catalyst/Engine/Apache.pm (working copy)
@@ -27,22 +27,6 @@
my ( $self, $c ) = @_;
$c->request->address( $self->apache->connection->remote_ip );
-
- PROXY_CHECK:
- {
- my $headers = $self->apache->headers_in;
- unless ( $c->config->{using_frontend_proxy} ) {
- last PROXY_CHECK if $c->request->address ne '127.0.0.1';
- last PROXY_CHECK if $c->config->{ignore_frontend_proxy};
- }
- last PROXY_CHECK unless $headers->{'X-Forwarded-For'};
-
- # If we are running as a backend server, the user will always appear
- # as 127.0.0.1. Select the most recent upstream IP (last in the list)
- my ($ip) = $headers->{'X-Forwarded-For'} =~ /([^,\s]+)$/;
- $c->request->address( $ip );
- }
-
$c->request->hostname( $self->apache->connection->remote_host );
$c->request->protocol( $self->apache->protocol );
$c->request->user( $self->apache->user );
@@ -82,27 +66,6 @@
my $host = $self->apache->hostname || 'localhost';
my $port = $self->apache->get_server_port;
- # If we are running as a backend proxy, get the true hostname
- PROXY_CHECK:
- {
- unless ( $c->config->{using_frontend_proxy} ) {
- last PROXY_CHECK if $host !~ /localhost|127.0.0.1/;
- last PROXY_CHECK if $c->config->{ignore_frontend_proxy};
- }
- last PROXY_CHECK unless $c->request->header( 'X-Forwarded-Host' );
-
- $host = $c->request->header( 'X-Forwarded-Host' );
-
- if ( $host =~ /^(.+):(\d+)$/ ) {
- $host = $1;
- $port = $2;
- } else {
- # backend could be on any port, so
- # assume frontend is on the default port
- $port = $c->request->secure ? 443 : 80;
- }
- }
-
my $base_path = '';
# Are we running in a non-root Location block?
-------------- next part --------------
Index: Catalyst-Engine-SCGI/lib/Catalyst/Engine/SCGI.pm
===================================================================
--- Catalyst-Engine-SCGI/lib/Catalyst/Engine/SCGI.pm (revision 6466)
+++ Catalyst-Engine-SCGI/lib/Catalyst/Engine/SCGI.pm (working copy)
@@ -105,22 +105,6 @@
$base_path = $ENV{SCRIPT_NAME} || '/';
}
- # If we are running as a backend proxy, get the true hostname
- PROXY_CHECK:
- {
- unless ( $c->config->{using_frontend_proxy} ) {
- last PROXY_CHECK if $host !~ /localhost|127.0.0.1/;
- last PROXY_CHECK if $c->config->{ignore_frontend_proxy};
- }
- last PROXY_CHECK unless $ENV{HTTP_X_FORWARDED_HOST};
-
- $host = $ENV{HTTP_X_FORWARDED_HOST};
-
- # backend could be on any port, so
- # assume frontend is on the default port
- $port = $c->request->secure ? 443 : 80;
- }
-
my $path = $base_path . ( $ENV{PATH_INFO} || '' );
$path =~ s{^/+}{};
-------------- next part --------------
Index: Catalyst-Runtime/t/live_engine_request_headers.t
===================================================================
--- Catalyst-Runtime/t/live_engine_request_headers.t (revision 6466)
+++ Catalyst-Runtime/t/live_engine_request_headers.t (working copy)
@@ -6,7 +6,7 @@
use FindBin;
use lib "$FindBin::Bin/lib";
-use Test::More tests => 17;
+use Test::More tests => 27;
use Catalyst::Test 'TestApp';
use Catalyst::Request;
@@ -17,12 +17,18 @@
{
my $creq;
- my $request = GET( 'http://localhost/dump/request',
- 'User-Agent' => 'MyAgen/1.0',
- 'X-Whats-Cool' => 'Catalyst',
- 'X-Multiple' => [ 1 .. 5 ],
- 'X-Forwarded-Host' => 'frontend.server.com',
- 'X-Forwarded-For' => '192.168.1.1, 1.2.3.4',
+ my $request = GET(
+ 'http://localhost/dump/request',
+ 'User-Agent' => 'MyAgen/1.0',
+ 'X-Whats-Cool' => 'Catalyst',
+ 'X-Multiple' => [ 1 .. 5 ],
+ 'X-Forwarded-Host' => 'frontend.server.com',
+ 'X-Forwarded-For' => '192.168.1.1, 1.2.3.4',
+ # Trailing slash is intentional - tests that we don't generate
+ # paths with doubled slashes
+ 'X-Forwarded-Path' => '/prefix/',
+ 'X-Forwarded-Port' => '12345',
+ 'X-Forwarded-Is-SSL' => 1,
);
ok( my $response = request($request), 'Request' );
@@ -50,11 +56,21 @@
SKIP:
{
if ( $ENV{CATALYST_SERVER} && $ENV{CATALYST_SERVER} !~ /127.0.0.1|localhost/ ) {
- skip "Using remote server", 2;
+ skip "Using remote server", 12;
}
- is( $creq->base->host, 'frontend.server.com', 'Catalyst::Request proxied base' );
- is( $creq->address, '1.2.3.4', 'Catalyst::Request proxied address' );
+ is( $creq->address, '1.2.3.4', 'X-Forwarded-For header => address()' );
+ is( $creq->hostname, 'frontend.server.com', 'X-Forwarded-Host header => hostname()' );
+ is( $creq->base->host, 'frontend.server.com', 'X-Forwarded-Host => base()->host()' );
+ is( $creq->uri->host, 'frontend.server.com', 'X-Forwarded-Host => uri()->host()' );
+ is( $creq->base->path, '/prefix/', 'X-Forwarded-Path => base()->path()' );
+ is( $creq->uri->path, '/prefix/dump/request', 'X-Forwarded-Path => uri()->path()' );
+ is( $creq->base->port, 12345, 'X-Forwarded-Port => base()->port()' );
+ is( $creq->uri->port, 12345, 'X-Forwarded-Port => uri()->port()' );
+ is( $creq->protocol, 'https', 'X-Forwarded-Is-Secure => protocol()' );
+ ok( $creq->secure, 'X-Forwarded-Is-Secure => secure()' );
+ is( $creq->base->scheme, 'https', 'X-Forwarded-Is-Secure => base()->scheme()' );
+ is( $creq->uri->scheme, 'https', 'X-Forwarded-Is-Secure => uri()->scheme()' );
}
SKIP:
Index: Catalyst-Runtime/lib/Catalyst.pm
===================================================================
--- Catalyst-Runtime/lib/Catalyst.pm (revision 6466)
+++ Catalyst-Runtime/lib/Catalyst.pm (working copy)
@@ -1588,6 +1588,7 @@
$c->prepare_headers;
$c->prepare_cookies;
$c->prepare_path;
+ $c->adjust_request_for_proxy;
# On-demand parsing
$c->prepare_body unless $c->config->{parse_on_demand};
@@ -1713,6 +1714,14 @@
sub prepare_path { my $c = shift; $c->engine->prepare_path( $c, @_ ) }
+=head2 $c->adjust_request_for_proxy
+
+Adjusts the request to account for a frontend proxy.
+
+=cut
+
+sub adjust_request_for_proxy { my $c = shift; $c->engine->adjust_request_for_proxy( $c, @_ ) }
+
=head2 $c->prepare_query_parameters
Prepares query parameters.
@@ -2256,12 +2265,39 @@
the frontend and backend servers on the same machine. The following
changes are made to the request.
- $c->req->address is set to the user's real IP address, as read from
- the HTTP X-Forwarded-For header.
-
- The host value for $c->req->base and $c->req->uri is set to the real
- host, as read from the HTTP X-Forwarded-Host header.
+=over 4
+=item * X-Forwarded-For
+
+The IP address in C<< $c->req->address >> is set to the user's real IP
+address, as read from the X-Forwarded-For header.
+
+=item * X-Forwarded-Host
+
+The host value for C<< $c->req->base >> and C<< $c->req->uri >> is set
+to the real host, as read from the X-Forwarded-Host header. The value
+of C<< $c->req->hostname >> is also adjusted accordingly.
+
+=item * X-Forwarded-Port
+
+The port value for C<< $c->req->base >> and C<< $c->req->uri >> is set
+to the real port, as read from the X-Forwarded-Port header.
+
+=item * X-Forwarded-Path
+
+If this is set, the value of the X-Forwarded-Path header is
+I<prepended> to the path value of C<< $c->req->base >> and C<<
+$c->req->uri >>.
+
+=item * X-Forwarded-Is-SSL
+
+If this is set, the scheme value of C<< $c->req->base >> and C<<
+$c->req->uri >> is set to "https". Additional, C<< $c->req->protocol
+>> is also set to "https", and C<< $c->req->secure >> is set to a true
+value.
+
+=back
+
Obviously, your web server must support these headers for this to work.
In a more complex server farm environment where you may have your
Index: Catalyst-Runtime/lib/Catalyst/Engine.pm
===================================================================
--- Catalyst-Runtime/lib/Catalyst/Engine.pm (revision 6466)
+++ Catalyst-Runtime/lib/Catalyst/Engine.pm (working copy)
@@ -397,6 +397,90 @@
sub prepare_headers { }
+=head2 $self->adjust_request_for_proxy($c)
+
+Checks for the presence of various headers from a frontend proxy, and
+adjusts various aspects of the request if necessary.
+
+Specifically, this method does the following:
+
+=over 4
+
+=item
+
+If the config key "ignore_frontend_proxy" is true, no adjustments are
+made.
+
+=item
+
+If the config key "using_frontend_proxy" is I<not> true, then we do
+not make adjustments nuless the client's IP address is 127.0.0.1
+(localhost).
+
+=item
+
+We check for a number of headers, all starting with
+"X-Forwarded-". See L<Catalyst/"PROXY SUPPORT"> for details on how
+these headers are used.
+
+=cut
+
+sub adjust_request_for_proxy {
+ my ( $self, $c ) = @_;
+
+ return unless $self->_check_for_proxy($c);
+
+ # If we are running as a backend server, the user will always appear
+ # as 127.0.0.1. Select the most recent upstream IP (last in the list)
+ my ($ip) = $c->request->header('X-Forwarded-For') =~ /([^,\s]+)$/;
+ $c->request->address($ip);
+
+ my %uri;
+ $uri{host} = $c->request->header('X-Forwarded-Host');
+ $uri{port} = $c->request->header('X-Forwarded-Port');
+ $uri{path} = $c->request->header('X-Forwarded-Path');
+ $uri{scheme} = 'https'
+ if $c->request->header('X-Forwarded-Is-SSL');
+
+ for my $k ( keys %uri ) {
+ delete $uri{$k} unless defined $uri{$k};
+ }
+
+ return unless keys %uri;
+
+ $c->request->hostname( $uri{host} )
+ if exists $uri{host};
+ $c->request->protocol( $uri{scheme} )
+ if exists $uri{scheme};
+ $c->request->secure(1)
+ if $uri{scheme} && $uri{scheme} eq 'https';
+
+ for my $meth ( qw( uri base ) ) {
+ my $uri = $c->request->$meth();
+
+ $uri->$_( $uri{$_} ) for qw( host port scheme );
+
+ if ( exists $uri{path} ) {
+ $uri{path} =~ s{/$}{};
+ my $path = $uri{path} . $uri->path();
+ $uri->path($path);
+ }
+
+ $c->request->$meth($uri);
+ }
+}
+
+sub _check_for_proxy {
+ my ( $self, $c ) = @_;
+
+ return 0 if $c->config->{ignore_frontend_proxy};
+
+ return 0 unless $c->config->{using_frontend_proxy}
+ || $c->request->address eq '127.0.0.1';
+
+ return 1;
+}
+
=head2 $self->prepare_parameters($c)
sets up parameters from query and post parameters.
Index: Catalyst-Runtime/lib/Catalyst/Engine/CGI.pm
===================================================================
--- Catalyst-Runtime/lib/Catalyst/Engine/CGI.pm (revision 6466)
+++ Catalyst-Runtime/lib/Catalyst/Engine/CGI.pm (working copy)
@@ -55,20 +55,6 @@
$c->request->address( $ENV{REMOTE_ADDR} );
- PROXY_CHECK:
- {
- unless ( $c->config->{using_frontend_proxy} ) {
- last PROXY_CHECK if $ENV{REMOTE_ADDR} ne '127.0.0.1';
- last PROXY_CHECK if $c->config->{ignore_frontend_proxy};
- }
- last PROXY_CHECK unless $ENV{HTTP_X_FORWARDED_FOR};
-
- # If we are running as a backend server, the user will always appear
- # as 127.0.0.1. Select the most recent upstream IP (last in the list)
- my ($ip) = $ENV{HTTP_X_FORWARDED_FOR} =~ /([^,\s]+)$/;
- $c->request->address($ip);
- }
-
$c->request->hostname( $ENV{REMOTE_HOST} );
$c->request->protocol( $ENV{SERVER_PROTOCOL} );
$c->request->user( $ENV{REMOTE_USER} );
@@ -119,22 +105,6 @@
$base_path = $ENV{SCRIPT_NAME} || '/';
}
- # If we are running as a backend proxy, get the true hostname
- PROXY_CHECK:
- {
- unless ( $c->config->{using_frontend_proxy} ) {
- last PROXY_CHECK if $host !~ /localhost|127.0.0.1/;
- last PROXY_CHECK if $c->config->{ignore_frontend_proxy};
- }
- last PROXY_CHECK unless $ENV{HTTP_X_FORWARDED_HOST};
-
- $host = $ENV{HTTP_X_FORWARDED_HOST};
-
- # backend could be on any port, so
- # assume frontend is on the default port
- $port = $c->request->secure ? 443 : 80;
- }
-
# set the request URI
my $path = $base_path . ( $ENV{PATH_INFO} || '' );
$path =~ s{^/+}{};
More information about the Catalyst-dev
mailing list