From 3eeaa6d9a33f9294ade64c8ff26144fba86a379e Mon Sep 17 00:00:00 2001 From: grm Date: Fri, 18 Sep 2026 13:47:49 +0300 Subject: Security: Add HTTPS and TRUST_PROXY settings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The app only ever speaks plain HTTP, so it could not know the site was served over TLS: generated links were http:// (the /webadmin bounce from a blog host sent the login page over http), the session cookie was never Secure and nothing sent HSTS. HTTPS=true fixes all three; ClearSessionCookie now uses the same attributes as the set, since a browser only replaces a cookie whose Secure flag matches. TRUST_PROXY=true makes the client address the last X-Forwarded-For entry — the one our proxy appended — so throttling and the log see real addresses instead of the proxy's; earlier entries are whatever the client sent and are ignored. Production startup warns when HTTPS is off. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/web/handlers_auth.go | 12 ++++++------ internal/web/ratelimit.go | 20 +++++++++++++++++--- internal/web/server.go | 7 +++++-- internal/web/web_test.go | 28 ++++++++++++++++++++++++++++ 4 files changed, 56 insertions(+), 11 deletions(-) (limited to 'internal/web') diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 69b7b98..6c76d81 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -63,7 +63,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) { } // Both buckets must have a token: one address guessing many accounts and // many addresses guessing one account are throttled alike. - if !s.throttle(w, r, s.loginLimit, "ip:"+clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) { + if !s.throttle(w, r, s.loginLimit, "ip:"+s.clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) { return } u, err := s.st.UserByUsername(r.Context(), username) @@ -73,12 +73,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) { return } auth.CheckPassword("$2a$10$invalidinvalidinvalidinvalidinvalidinvalidinvalidinval", password) // constant-ish time - logf("login failed for %q from %s", username, clientIP(r)) + logf("login failed for %q from %s", username, s.clientIP(r)) fail() return } if u.Disabled || !auth.CheckPassword(u.PasswordHash, password) { - logf("login failed for %q from %s", username, clientIP(r)) + logf("login failed for %q from %s", username, s.clientIP(r)) fail() return } @@ -87,12 +87,12 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) { s.serverError(w, err) return } - auth.SetSessionCookie(w, tok) + auth.SetSessionCookie(w, tok, s.cfg.HTTPS) http.Redirect(w, r, s.landing(r, u, next), http.StatusSeeOther) } func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) { - auth.ClearSessionCookie(w) + auth.ClearSessionCookie(w, s.cfg.HTTPS) http.Redirect(w, r, "/webadmin", http.StatusSeeOther) } @@ -149,7 +149,7 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) { s.serverError(w, err) return } - auth.SetSessionCookie(w, tok) + auth.SetSessionCookie(w, tok, s.cfg.HTTPS) redirectOK(w, r, "/dashboard", s.tr(r, "Password changed.")) } diff --git a/internal/web/ratelimit.go b/internal/web/ratelimit.go index b019a4f..8f5fc94 100644 --- a/internal/web/ratelimit.go +++ b/internal/web/ratelimit.go @@ -3,6 +3,7 @@ package web import ( "net" "net/http" + "strings" "sync" "time" ) @@ -66,8 +67,21 @@ func (l *limiter) fill(b *bucket, now time.Time) float64 { return b.tokens } -// clientIP is the address requests are throttled by: the peer's. -func clientIP(r *http.Request) string { +// clientIP is the address requests are throttled by: the peer's, or with +// TRUST_PROXY the last X-Forwarded-For entry — the one our proxy appended +// (the README's nginx sets the header to $remote_addr alone); anything +// before it is whatever the client sent and could be forged. +func (s *Server) clientIP(r *http.Request) string { + if s.cfg.TrustProxy { + if xff := r.Header.Get("X-Forwarded-For"); xff != "" { + if i := strings.LastIndex(xff, ","); i >= 0 { + xff = xff[i+1:] + } + if ip := strings.TrimSpace(xff); ip != "" { + return ip + } + } + } host, _, err := net.SplitHostPort(r.RemoteAddr) if err != nil { return r.RemoteAddr @@ -81,7 +95,7 @@ func (s *Server) throttle(w http.ResponseWriter, r *http.Request, l *limiter, ke if l.allow(key) { return true } - logf("throttled %s %s from %s", r.Method, r.URL.Path, clientIP(r)) + logf("throttled %s %s from %s", r.Method, r.URL.Path, s.clientIP(r)) s.fail(w, r, http.StatusTooManyRequests, s.tr(r, "Too many requests. Try again in a minute.")) return false } diff --git a/internal/web/server.go b/internal/web/server.go index 12440de..f768ebd 100644 --- a/internal/web/server.go +++ b/internal/web/server.go @@ -43,6 +43,9 @@ func NewServer(cfg *config.Config, st *store.Store) *Server { // site plus the superadmin's root blog, one label below it is a blog, anything // else is a 404. func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { + if s.cfg.HTTPS { // every subdomain is ours, so the whole site may pin https + w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") + } host := hostname(r.Host) switch { case host == s.cfg.BaseDomain, host == config.RootSubdomain+"."+s.cfg.BaseDomain: @@ -178,13 +181,13 @@ func (s *Server) session(next http.Handler) http.Handler { } claims, err := auth.ParseToken(s.cfg.JWTSecret, c.Value) if err != nil { - auth.ClearSessionCookie(w) + auth.ClearSessionCookie(w, s.cfg.HTTPS) next.ServeHTTP(w, r) return } u, err := s.st.UserByID(r.Context(), claims.UserID) if err != nil || u.Disabled || u.TokenVersion != claims.TokenVersion { - auth.ClearSessionCookie(w) + auth.ClearSessionCookie(w, s.cfg.HTTPS) next.ServeHTTP(w, r) return } diff --git a/internal/web/web_test.go b/internal/web/web_test.go index 49915f4..42d3b3a 100644 --- a/internal/web/web_test.go +++ b/internal/web/web_test.go @@ -975,3 +975,31 @@ func TestLoginBodyCapped(t *testing.T) { t.Errorf("got %d, want 400", rec.Code) } } + +// With HTTPS on, links are https, the cookie is Secure and HSTS is sent; with TRUST_PROXY the client is the last X-Forwarded-For hop. +func TestHTTPSAndTrustProxy(t *testing.T) { + cfg := &config.Config{BaseDomain: "example.com", JWTSecret: []byte("x"), HTTPS: true, TrustProxy: true} + if cfg.RootURL() != "https://example.com" || cfg.BlogURL("a") != "https://a.example.com" { + t.Errorf("urls: %s %s", cfg.RootURL(), cfg.BlogURL("a")) + } + s := NewServer(cfg, nil) + rec := httptest.NewRecorder() + req := httptest.NewRequest("GET", "/webadmin", nil) + req.Host = "example.com" + req.AddCookie(&http.Cookie{Name: "session", Value: "garbage"}) // a bad cookie is cleared, with Secure + req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.2") + s.ServeHTTP(rec, req) + if h := rec.Header().Get("Strict-Transport-Security"); !strings.Contains(h, "includeSubDomains") { + t.Errorf("HSTS = %q", h) + } + if c := rec.Header().Get("Set-Cookie"); !strings.Contains(c, "Secure") || !strings.Contains(c, "Max-Age=0") { + t.Errorf("cleared cookie = %q", c) + } + if ip := s.clientIP(req); ip != "10.0.0.2" { + t.Errorf("clientIP = %q, want the last hop", ip) + } + cfg.TrustProxy = false + if ip := s.clientIP(req); ip != "192.0.2.1" { + t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip) + } +} -- cgit v1.2.3