| commit | 88ed322afcd8cddc0e1ae5d02fd4d86779a4a2a3 | [log] [tgz] |
|---|---|---|
| author | Kévin Dunglas <dunglas@gmail.com> | Tue Jan 21 21:48:41 2020 +0000 |
| committer | Brad Fitzpatrick <bradfitz@golang.org> | Tue Jan 21 21:51:46 2020 +0000 |
| tree | fa5f51de778f27a426832740d16572fcafdcdfac | |
| parent | 71239b4f491698397149868c88d2c851de2cd49b [diff] |
net/http/httputil: add docs about X-Forwarded-For in ReverseProxy ReverseProxy automatically sets the X-Forwarded-For header, if the request already contains a X-Forwarded-For header, the value of the client IP is appended to the existing header value. This behavior isn't documented anywhere, and can lead to IP spoofing security issues is the client is untrusted (the most common situation). This PR documents this behavior. For future versions, I proposed #36678 that implements a more secure default behavior and adds support for other forwarded headers. Change-Id: Ief14f5063caebfccb87714f54cffa927c714e5fd GitHub-Last-Rev: fd0bd29a181861ffdb1106b42f59f9489999ccb3 GitHub-Pull-Request: golang/go#36672 Reviewed-on: https://go-review.googlesource.com/c/go/+/215617 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://golang.org/dl/.
After downloading a binary release, visit https://golang.org/doc/install or load doc/install.html in your web browser for installation instructions.
If a binary distribution is not available for your combination of operating system and architecture, visit https://golang.org/doc/install/source or load doc/install-source.html in your web browser for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://golang.org/wiki/Questions for a list of places to ask questions about the Go language.