aboutsummaryrefslogtreecommitdiffstats
path: root/internal
diff options
context:
space:
mode:
Diffstat (limited to 'internal')
-rw-r--r--internal/auth/cookie.go27
-rw-r--r--internal/config/config.go20
-rw-r--r--internal/web/handlers_auth.go12
-rw-r--r--internal/web/ratelimit.go20
-rw-r--r--internal/web/server.go7
-rw-r--r--internal/web/web_test.go28
6 files changed, 92 insertions, 22 deletions
diff --git a/internal/auth/cookie.go b/internal/auth/cookie.go
index 9fd6b6e..8fa394d 100644
--- a/internal/auth/cookie.go
+++ b/internal/auth/cookie.go
@@ -7,17 +7,26 @@ import (
const CookieName = "session"
-func SetSessionCookie(w http.ResponseWriter, token string) {
- http.SetCookie(w, &http.Cookie{
+// SetSessionCookie sets the session cookie; secure marks it for https only,
+// which the app cannot tell on its own behind a plain-http proxy.
+func SetSessionCookie(w http.ResponseWriter, token string, secure bool) {
+ http.SetCookie(w, sessionCookie(token, int(SessionTTL/time.Second), secure))
+}
+
+// ClearSessionCookie expires the cookie with the same attributes it was set
+// with; browsers only replace a cookie whose Secure flag matches.
+func ClearSessionCookie(w http.ResponseWriter, secure bool) {
+ http.SetCookie(w, sessionCookie("", -1, secure))
+}
+
+func sessionCookie(value string, maxAge int, secure bool) *http.Cookie {
+ return &http.Cookie{
Name: CookieName,
- Value: token,
+ Value: value,
Path: "/",
HttpOnly: true,
+ Secure: secure,
SameSite: http.SameSiteLaxMode,
- MaxAge: int(SessionTTL / time.Second),
- })
-}
-
-func ClearSessionCookie(w http.ResponseWriter) {
- http.SetCookie(w, &http.Cookie{Name: CookieName, Value: "", Path: "/", HttpOnly: true, MaxAge: -1})
+ MaxAge: maxAge,
+ }
}
diff --git a/internal/config/config.go b/internal/config/config.go
index a239aa2..c231860 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -19,6 +19,12 @@ type Config struct {
SuperadminPassword string
MaxUploadBytes int64 // default per-file limit; the superadmin can override it per blog
Dev bool // reload templates/static from disk
+ // HTTPS says the proxy in front terminates TLS: generated links are
+ // https://, the session cookie is Secure and HSTS is sent.
+ HTTPS bool
+ // TrustProxy says X-Forwarded-For was written by our own proxy, so its
+ // last entry is the client address (for throttling and the log).
+ TrustProxy bool
}
func Load() (*Config, error) {
@@ -31,6 +37,8 @@ func Load() (*Config, error) {
SuperadminUsername: env("SUPERADMIN_USERNAME", "admin"),
SuperadminPassword: env("SUPERADMIN_PASSWORD", ""),
Dev: envBool("DEV", false),
+ HTTPS: envBool("HTTPS", false),
+ TrustProxy: envBool("TRUST_PROXY", false),
}
mb, err := strconv.Atoi(env("MAX_UPLOAD_MB", "10"))
if err != nil || mb <= 0 {
@@ -62,12 +70,20 @@ func (c *Config) BlogURL(sub string) string {
if sub == RootSubdomain {
return c.RootURL()
}
- return "http://" + sub + "." + c.HostWithPort()
+ return c.Scheme() + "://" + sub + "." + c.HostWithPort()
}
// RootURL returns the public URL of the management site.
func (c *Config) RootURL() string {
- return "http://" + c.HostWithPort()
+ return c.Scheme() + "://" + c.HostWithPort()
+}
+
+// Scheme is the one the public reaches the site by.
+func (c *Config) Scheme() string {
+ if c.HTTPS {
+ return "https"
+ }
+ return "http"
}
func (c *Config) HostWithPort() string {
diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go
index 69b7b98..6c76d81 100644
--- a/internal/web/handlers_auth.go
+++ b/internal/web/handlers_auth.go
@@ -63,7 +63,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
}
// Both buckets must have a token: one address guessing many accounts and
// many addresses guessing one account are throttled alike.
- if !s.throttle(w, r, s.loginLimit, "ip:"+clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) {
+ if !s.throttle(w, r, s.loginLimit, "ip:"+s.clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) {
return
}
u, err := s.st.UserByUsername(r.Context(), username)
@@ -73,12 +73,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
return
}
auth.CheckPassword("$2a$10$invalidinvalidinvalidinvalidinvalidinvalidinvalidinval", password) // constant-ish time
- logf("login failed for %q from %s", username, clientIP(r))
+ logf("login failed for %q from %s", username, s.clientIP(r))
fail()
return
}
if u.Disabled || !auth.CheckPassword(u.PasswordHash, password) {
- logf("login failed for %q from %s", username, clientIP(r))
+ logf("login failed for %q from %s", username, s.clientIP(r))
fail()
return
}
@@ -87,12 +87,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
s.serverError(w, err)
return
}
- auth.SetSessionCookie(w, tok)
+ auth.SetSessionCookie(w, tok, s.cfg.HTTPS)
http.Redirect(w, r, s.landing(r, u, next), http.StatusSeeOther)
}
func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
- auth.ClearSessionCookie(w)
+ auth.ClearSessionCookie(w, s.cfg.HTTPS)
http.Redirect(w, r, "/webadmin", http.StatusSeeOther)
}
@@ -149,7 +149,7 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) {
s.serverError(w, err)
return
}
- auth.SetSessionCookie(w, tok)
+ auth.SetSessionCookie(w, tok, s.cfg.HTTPS)
redirectOK(w, r, "/dashboard", s.tr(r, "Password changed."))
}
diff --git a/internal/web/ratelimit.go b/internal/web/ratelimit.go
index b019a4f..8f5fc94 100644
--- a/internal/web/ratelimit.go
+++ b/internal/web/ratelimit.go
@@ -3,6 +3,7 @@ package web
import (
"net"
"net/http"
+ "strings"
"sync"
"time"
)
@@ -66,8 +67,21 @@ func (l *limiter) fill(b *bucket, now time.Time) float64 {
return b.tokens
}
-// clientIP is the address requests are throttled by: the peer's.
-func clientIP(r *http.Request) string {
+// clientIP is the address requests are throttled by: the peer's, or with
+// TRUST_PROXY the last X-Forwarded-For entry — the one our proxy appended
+// (the README's nginx sets the header to $remote_addr alone); anything
+// before it is whatever the client sent and could be forged.
+func (s *Server) clientIP(r *http.Request) string {
+ if s.cfg.TrustProxy {
+ if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+ if i := strings.LastIndex(xff, ","); i >= 0 {
+ xff = xff[i+1:]
+ }
+ if ip := strings.TrimSpace(xff); ip != "" {
+ return ip
+ }
+ }
+ }
host, _, err := net.SplitHostPort(r.RemoteAddr)
if err != nil {
return r.RemoteAddr
@@ -81,7 +95,7 @@ func (s *Server) throttle(w http.ResponseWriter, r *http.Request, l *limiter, ke
if l.allow(key) {
return true
}
- logf("throttled %s %s from %s", r.Method, r.URL.Path, clientIP(r))
+ logf("throttled %s %s from %s", r.Method, r.URL.Path, s.clientIP(r))
s.fail(w, r, http.StatusTooManyRequests, s.tr(r, "Too many requests. Try again in a minute."))
return false
}
diff --git a/internal/web/server.go b/internal/web/server.go
index 12440de..f768ebd 100644
--- a/internal/web/server.go
+++ b/internal/web/server.go
@@ -43,6 +43,9 @@ func NewServer(cfg *config.Config, st *store.Store) *Server {
// site plus the superadmin's root blog, one label below it is a blog, anything
// else is a 404.
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+ if s.cfg.HTTPS { // every subdomain is ours, so the whole site may pin https
+ w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+ }
host := hostname(r.Host)
switch {
case host == s.cfg.BaseDomain, host == config.RootSubdomain+"."+s.cfg.BaseDomain:
@@ -178,13 +181,13 @@ func (s *Server) session(next http.Handler) http.Handler {
}
claims, err := auth.ParseToken(s.cfg.JWTSecret, c.Value)
if err != nil {
- auth.ClearSessionCookie(w)
+ auth.ClearSessionCookie(w, s.cfg.HTTPS)
next.ServeHTTP(w, r)
return
}
u, err := s.st.UserByID(r.Context(), claims.UserID)
if err != nil || u.Disabled || u.TokenVersion != claims.TokenVersion {
- auth.ClearSessionCookie(w)
+ auth.ClearSessionCookie(w, s.cfg.HTTPS)
next.ServeHTTP(w, r)
return
}
diff --git a/internal/web/web_test.go b/internal/web/web_test.go
index 49915f4..42d3b3a 100644
--- a/internal/web/web_test.go
+++ b/internal/web/web_test.go
@@ -975,3 +975,31 @@ func TestLoginBodyCapped(t *testing.T) {
t.Errorf("got %d, want 400", rec.Code)
}
}
+
+// With HTTPS on, links are https, the cookie is Secure and HSTS is sent; with TRUST_PROXY the client is the last X-Forwarded-For hop.
+func TestHTTPSAndTrustProxy(t *testing.T) {
+ cfg := &config.Config{BaseDomain: "example.com", JWTSecret: []byte("x"), HTTPS: true, TrustProxy: true}
+ if cfg.RootURL() != "https://example.com" || cfg.BlogURL("a") != "https://a.example.com" {
+ t.Errorf("urls: %s %s", cfg.RootURL(), cfg.BlogURL("a"))
+ }
+ s := NewServer(cfg, nil)
+ rec := httptest.NewRecorder()
+ req := httptest.NewRequest("GET", "/webadmin", nil)
+ req.Host = "example.com"
+ req.AddCookie(&http.Cookie{Name: "session", Value: "garbage"}) // a bad cookie is cleared, with Secure
+ req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.2")
+ s.ServeHTTP(rec, req)
+ if h := rec.Header().Get("Strict-Transport-Security"); !strings.Contains(h, "includeSubDomains") {
+ t.Errorf("HSTS = %q", h)
+ }
+ if c := rec.Header().Get("Set-Cookie"); !strings.Contains(c, "Secure") || !strings.Contains(c, "Max-Age=0") {
+ t.Errorf("cleared cookie = %q", c)
+ }
+ if ip := s.clientIP(req); ip != "10.0.0.2" {
+ t.Errorf("clientIP = %q, want the last hop", ip)
+ }
+ cfg.TrustProxy = false
+ if ip := s.clientIP(req); ip != "192.0.2.1" {
+ t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip)
+ }
+}
generated by cgit v1.2.3 (git 2.25.1) at 2026-10-06 01:38:32 +0000