4 files changed, 56 insertions, 11 deletions
diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go
index 69b7b98..6c76d81 100644
--- a/internal/web/handlers_auth.go
+++ b/internal/web/handlers_auth.go
@@ -63,7 +63,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 	// Both buckets must have a token: one address guessing many accounts and
 	// many addresses guessing one account are throttled alike.
-	if !s.throttle(w, r, s.loginLimit, "ip:"+clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) {
+	if !s.throttle(w, r, s.loginLimit, "ip:"+s.clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) {
 		return
 	}
 	u, err := s.st.UserByUsername(r.Context(), username)
@@ -73,12 +73,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		auth.CheckPassword("$2a$10$invalidinvalidinvalidinvalidinvalidinvalidinvalidinval", password) // constant-ish time
-		logf("login failed for %q from %s", username, clientIP(r))
+		logf("login failed for %q from %s", username, s.clientIP(r))
 		fail()
 		return
 	}
 	if u.Disabled || !auth.CheckPassword(u.PasswordHash, password) {
-		logf("login failed for %q from %s", username, clientIP(r))
+		logf("login failed for %q from %s", username, s.clientIP(r))
 		fail()
 		return
 	}
@@ -87,12 +87,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		s.serverError(w, err)
 		return
 	}
-	auth.SetSessionCookie(w, tok)
+	auth.SetSessionCookie(w, tok, s.cfg.HTTPS)
 	http.Redirect(w, r, s.landing(r, u, next), http.StatusSeeOther)
 }
 
 func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
-	auth.ClearSessionCookie(w)
+	auth.ClearSessionCookie(w, s.cfg.HTTPS)
 	http.Redirect(w, r, "/webadmin", http.StatusSeeOther)
 }
 
@@ -149,7 +149,7 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) {
 		s.serverError(w, err)
 		return
 	}
-	auth.SetSessionCookie(w, tok)
+	auth.SetSessionCookie(w, tok, s.cfg.HTTPS)
 	redirectOK(w, r, "/dashboard", s.tr(r, "Password changed."))
 }
 
diff --git a/internal/web/ratelimit.go b/internal/web/ratelimit.go
index b019a4f..8f5fc94 100644
--- a/internal/web/ratelimit.go
+++ b/internal/web/ratelimit.go
@@ -3,6 +3,7 @@ package web
 import (
 	"net"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 )
@@ -66,8 +67,21 @@ func (l *limiter) fill(b *bucket, now time.Time) float64 {
 	return b.tokens
 }
 
-// clientIP is the address requests are throttled by: the peer's.
-func clientIP(r *http.Request) string {
+// clientIP is the address requests are throttled by: the peer's, or with
+// TRUST_PROXY the last X-Forwarded-For entry — the one our proxy appended
+// (the README's nginx sets the header to $remote_addr alone); anything
+// before it is whatever the client sent and could be forged.
+func (s *Server) clientIP(r *http.Request) string {
+	if s.cfg.TrustProxy {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			if i := strings.LastIndex(xff, ","); i >= 0 {
+				xff = xff[i+1:]
+			}
+			if ip := strings.TrimSpace(xff); ip != "" {
+				return ip
+			}
+		}
+	}
 	host, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
 		return r.RemoteAddr
@@ -81,7 +95,7 @@ func (s *Server) throttle(w http.ResponseWriter, r *http.Request, l *limiter, ke
 	if l.allow(key) {
 		return true
 	}
-	logf("throttled %s %s from %s", r.Method, r.URL.Path, clientIP(r))
+	logf("throttled %s %s from %s", r.Method, r.URL.Path, s.clientIP(r))
 	s.fail(w, r, http.StatusTooManyRequests, s.tr(r, "Too many requests. Try again in a minute."))
 	return false
 }
diff --git a/internal/web/server.go b/internal/web/server.go
index 12440de..f768ebd 100644
--- a/internal/web/server.go
+++ b/internal/web/server.go
@@ -43,6 +43,9 @@ func NewServer(cfg *config.Config, st *store.Store) *Server {
 // site plus the superadmin's root blog, one label below it is a blog, anything
 // else is a 404.
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if s.cfg.HTTPS { // every subdomain is ours, so the whole site may pin https
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+	}
 	host := hostname(r.Host)
 	switch {
 	case host == s.cfg.BaseDomain, host == config.RootSubdomain+"."+s.cfg.BaseDomain:
@@ -178,13 +181,13 @@ func (s *Server) session(next http.Handler) http.Handler {
 		}
 		claims, err := auth.ParseToken(s.cfg.JWTSecret, c.Value)
 		if err != nil {
-			auth.ClearSessionCookie(w)
+			auth.ClearSessionCookie(w, s.cfg.HTTPS)
 			next.ServeHTTP(w, r)
 			return
 		}
 		u, err := s.st.UserByID(r.Context(), claims.UserID)
 		if err != nil || u.Disabled || u.TokenVersion != claims.TokenVersion {
-			auth.ClearSessionCookie(w)
+			auth.ClearSessionCookie(w, s.cfg.HTTPS)
 			next.ServeHTTP(w, r)
 			return
 		}
diff --git a/internal/web/web_test.go b/internal/web/web_test.go
index 49915f4..42d3b3a 100644
--- a/internal/web/web_test.go
+++ b/internal/web/web_test.go
@@ -975,3 +975,31 @@ func TestLoginBodyCapped(t *testing.T) {
 		t.Errorf("got %d, want 400", rec.Code)
 	}
 }
+
+// With HTTPS on, links are https, the cookie is Secure and HSTS is sent; with TRUST_PROXY the client is the last X-Forwarded-For hop.
+func TestHTTPSAndTrustProxy(t *testing.T) {
+	cfg := &config.Config{BaseDomain: "example.com", JWTSecret: []byte("x"), HTTPS: true, TrustProxy: true}
+	if cfg.RootURL() != "https://example.com" || cfg.BlogURL("a") != "https://a.example.com" {
+		t.Errorf("urls: %s %s", cfg.RootURL(), cfg.BlogURL("a"))
+	}
+	s := NewServer(cfg, nil)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/webadmin", nil)
+	req.Host = "example.com"
+	req.AddCookie(&http.Cookie{Name: "session", Value: "garbage"}) // a bad cookie is cleared, with Secure
+	req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.2")
+	s.ServeHTTP(rec, req)
+	if h := rec.Header().Get("Strict-Transport-Security"); !strings.Contains(h, "includeSubDomains") {
+		t.Errorf("HSTS = %q", h)
+	}
+	if c := rec.Header().Get("Set-Cookie"); !strings.Contains(c, "Secure") || !strings.Contains(c, "Max-Age=0") {
+		t.Errorf("cleared cookie = %q", c)
+	}
+	if ip := s.clientIP(req); ip != "10.0.0.2" {
+		t.Errorf("clientIP = %q, want the last hop", ip)
+	}
+	cfg.TrustProxy = false
+	if ip := s.clientIP(req); ip != "192.0.2.1" {
+		t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip)
+	}
+}