Calcium-Ion
31d70fca39
* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
52 lines
1.4 KiB
Go
52 lines
1.4 KiB
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
var defaultTrustedProxyCIDRs = []string{
|
|
"127.0.0.0/8",
|
|
"::1",
|
|
"10.0.0.0/8",
|
|
"172.16.0.0/12",
|
|
"192.168.0.0/16",
|
|
"fc00::/7",
|
|
}
|
|
|
|
func configureTrustedProxies(engine *gin.Engine) error {
|
|
rawTrustedProxies := strings.TrimSpace(os.Getenv("TRUSTED_PROXIES"))
|
|
if rawTrustedProxies == "" {
|
|
log.Print("WARNING: TRUSTED_PROXIES is unset or blank; trusting loopback, RFC 1918, and IPv6 ULA proxy addresses for compatibility. Set TRUSTED_PROXIES=none to trust no proxies, or configure explicit proxy IPs/CIDRs to replace these defaults.")
|
|
return engine.SetTrustedProxies(defaultTrustedProxyCIDRs)
|
|
}
|
|
if strings.EqualFold(rawTrustedProxies, "none") {
|
|
return engine.SetTrustedProxies(nil)
|
|
}
|
|
|
|
parts := strings.Split(rawTrustedProxies, ",")
|
|
trustedProxies := make([]string, 0, len(parts))
|
|
for _, part := range parts {
|
|
trustedProxy := strings.TrimSpace(part)
|
|
if trustedProxy == "" {
|
|
continue
|
|
}
|
|
if strings.EqualFold(trustedProxy, "none") {
|
|
return errors.New("TRUSTED_PROXIES=none must be used alone")
|
|
}
|
|
trustedProxies = append(trustedProxies, trustedProxy)
|
|
}
|
|
if len(trustedProxies) == 0 {
|
|
return errors.New("TRUSTED_PROXIES does not contain an IP address or CIDR")
|
|
}
|
|
if err := engine.SetTrustedProxies(trustedProxies); err != nil {
|
|
return fmt.Errorf("invalid TRUSTED_PROXIES: %w", err)
|
|
}
|
|
return nil
|
|
}
|