aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/httputil/reverseproxy.go
AgeCommit message (Collapse)Author
2022-09-28[release-branch.go1.18] net/http/httputil: avoid query parameter smugglingDamien Neil
Query parameter smuggling occurs when a proxy's interpretation of query parameters differs from that of a downstream server. Change ReverseProxy to avoid forwarding ignored query parameters. Remove unparsable query parameters from the outbound request * if req.Form != nil after calling ReverseProxy.Director; and * before calling ReverseProxy.Rewrite. This change preserves the existing behavior of forwarding the raw query untouched if a Director hook does not parse the query by calling Request.ParseForm (possibly indirectly). Fixes #55842 For #54663 For CVE-2022-2880 Change-Id: If1621f6b0e73a49d79059dae9e6b256e0ff18ca9 Reviewed-on: https://go-review.googlesource.com/c/go/+/432976 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> (cherry picked from commit 7c84234142149bd24a4096c6cab691d3593f3431) Reviewed-on: https://go-review.googlesource.com/c/go/+/433695 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2021-12-13all: gofmt -w -r 'interface{} -> any' srcRuss Cox
And then revert the bootstrap cmd directories and certain testdata. And adjust tests as needed. Not reverting the changes in std that are bootstrapped, because some of those changes would appear in API docs, and we want to use any consistently. Instead, rewrite 'any' to 'interface{}' in cmd/dist for those directories when preparing the bootstrap copy. A few files changed as a result of running gofmt -w not because of interface{} -> any but because they hadn't been updated for the new //go:build lines. Fixes #49884. Change-Id: Ie8045cba995f65bd79c694ec77a1b3d1fe01bb09 Reviewed-on: https://go-review.googlesource.com/c/go/+/368254 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-10-13net/http/httputil: allow MIME parameters when detecting SSE in ReverseProxyJames Harris
This change allows httputil.ReverseProxy to detect SSE (server-sent events) content when the response's Content-Type header includes MIME parameters, such as "text/event-stream;charset=utf-8". Prior to this change the value of the Content-Type header was compared directly to the literal "text/event-stream". This caused a false-negative which failed to set the FlushInterval correctly when MIME parameters were present. Change-Id: If8bb43efb78787b6519d7fe7599ca018a0da0023 GitHub-Last-Rev: 224518c5eb9686ee050c79f5f853ebacfdf6fc42 GitHub-Pull-Request: golang/go#48427 Reviewed-on: https://go-review.googlesource.com/c/go/+/350509 Trust: Alexander Rakoczy <alex@golang.org> Trust: Damien Neil <dneil@google.com> Run-TryBot: Alexander Rakoczy <alex@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2021-07-30net/http/httputil: close incoming ReverseProxy request bodyDamien Neil
Reading from an incoming request body after the request handler aborts with a panic can cause a panic, becuse http.Server does not (contrary to its documentation) close the request body in this case. Always close the incoming request body in ReverseProxy.ServeHTTP to ensure that any in-flight outgoing requests using the body do not read from it. Updates #46866 Fixes CVE-2021-36221 Change-Id: I310df269200ad8732c5d9f1a2b00de68725831df Reviewed-on: https://go-review.googlesource.com/c/go/+/333191 Trust: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-05-27net/http/httputil: always remove hop-by-hop headersFilippo Valsorda
Previously, we'd fail to remove the Connection header from a request like this: Connection: Connection: x-header Fixes #46313 Fixes CVE-2021-33197 Change-Id: Ie3009e926ceecfa86dfa6bcc6fe14ff01086be7d Reviewed-on: https://go-review.googlesource.com/c/go/+/321929 Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Katie Hockman <katie@golang.org> Trust: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org>
2021-05-10net/http: switch HTTP1 to ASCII equivalents of string functionsRoberto Clapis
The current implementation uses UTF-aware functions like strings.EqualFold and strings.ToLower. This could, in some cases, cause http smuggling. Change-Id: I0e76a993470a1e1b1b472f4b2859ea0a2b22ada0 Reviewed-on: https://go-review.googlesource.com/c/go/+/308009 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Trust: Roberto Clapis <roberto@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-04-10all: fix spellingsNaman Gera
This follows the spelling choices that the Go project has made for English words. https://github.com/golang/go/wiki/Spelling Change-Id: Ie7c586d2cf23020cb492cfff58c0831d2d8d3a78 GitHub-Last-Rev: e16a32cd225a275f73d236bcb33703986d110ded GitHub-Pull-Request: golang/go#45442 Reviewed-on: https://go-review.googlesource.com/c/go/+/308291 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Trust: Emmanuel Odeke <emmanuel@orijtech.com>
2020-10-19net/http/httputil: copy response header back to http.ResponseWriter in ↵Aofei Sheng
ReverseProxy.handleUpgradeResponse Fixes: #41634 Change-Id: Ib78cc37a4d2ca0753d567eafb616238e4103484e Reviewed-on: https://go-review.googlesource.com/c/go/+/257777 Reviewed-by: Damien Neil <dneil@google.com> Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-12net/http/httputil: flush ReverseProxy immediately if Content-Length is -1Ignacio Hagopian
Finish up a prior TODO by making ReverseProxy flush immediately if Content-Length is -1, which is a case that can occur if for example we have a streamed response, or chunked encoding, or when the body's length wasn't known. Fixes #41642 Change-Id: I30babaaf3e14837b99e3ecdc562a0a0e50c579bf GitHub-Last-Rev: efc019a9fe361082d40bee77317018c3b80451a3 GitHub-Pull-Request: golang/go#41858 Reviewed-on: https://go-review.googlesource.com/c/go/+/260637 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Trust: Ian Lance Taylor <iant@golang.org> Trust: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-05-06net/http: use ASCII space trimming throughoutFilippo Valsorda
Security hardening against HTTP request smuggling. Thank you to ZeddYu for reporting this issue. Change-Id: I98bd9f8ffe58360fc3bca9dc5d9a106773e55373 Reviewed-on: https://go-review.googlesource.com/c/go/+/231419 Reviewed-by: Katie Hockman <katie@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-05-02net/http/httputil: handle escaped paths in SingleHostReverseProxyDaniel Kumor
When forwarding a request, a SingleHostReverseProxy appends the request's path to the target URL's path. However, if certain path elements are encoded, (such as %2F for slash in either the request or target path), simply joining the URL.Path elements is not sufficient, since the field holds the decoded path. Since 87a605, the RawPath field was added which holds a decoding hint for the URL. When joining URL paths, this decoding hint needs to be taken into consideration. As an example, if the target URL.Path is /a/b, and URL.RawPath is /a%2Fb, joining the path with /c should result in /a/b/c in URL.Path, and /a%2Fb/c in RawPath. The added joinURLPath function combines the two URL's Paths, while taking into account escaping, and replaces the previously used singleJoiningSlash in NewSingleHostReverseProxy. Fixes #35908 Change-Id: I45886aee548431fe4031883ab1629a41e35f1727 GitHub-Last-Rev: 7be6b8d421c63928639f499b984a821585992c2b GitHub-Pull-Request: golang/go#36378 Reviewed-on: https://go-review.googlesource.com/c/go/+/213257 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-04-30net/http/httputil: don't append to X-Forwarded-For in ReverseProxy when nilBrad Fitzpatrick
Fixes #38079 Change-Id: Iac02d7f9574061bb26d1d9a41bb6ee6cc38934e5 Reviewed-on: https://go-review.googlesource.com/c/go/+/230937 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-04-26net/http/httputil: make Switching Protocol requests (e.g. Websockets) cancelablePierre Carru
Ensures that a canceled client request for Switching Protocols (e.g. h2c, Websockets) will cause the underlying connection to be terminated. Adds a goroutine in handleUpgradeResponse in order to select on the incoming client request's context and appropriately cancel it. Fixes #35559 Change-Id: I1238e18fd4cce457f034f78d9cdce0e7f93b8bf6 GitHub-Last-Rev: 3629c78493f667703ea99f9f4db5e63ddaaa0e6b GitHub-Pull-Request: golang/go#38021 Reviewed-on: https://go-review.googlesource.com/c/go/+/224897 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-01-21net/http/httputil: add docs about X-Forwarded-For in ReverseProxyKévin Dunglas
ReverseProxy automatically sets the X-Forwarded-For header, if the request already contains a X-Forwarded-For header, the value of the client IP is appended to the existing header value. This behavior isn't documented anywhere, and can lead to IP spoofing security issues is the client is untrusted (the most common situation). This PR documents this behavior. For future versions, I proposed #36678 that implements a more secure default behavior and adds support for other forwarded headers. Change-Id: Ief14f5063caebfccb87714f54cffa927c714e5fd GitHub-Last-Rev: fd0bd29a181861ffdb1106b42f59f9489999ccb3 GitHub-Pull-Request: golang/go#36672 Reviewed-on: https://go-review.googlesource.com/c/go/+/215617 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-07-17net/http/httputil: fix regression in ReverseProxy.ServeHTTPJoe Tsai
In Go1.12 and below, the logic in ReverseProxy.ServeHTTP would always allocate request.Header even if it were not present in the incoming request. CL 174324 added http.Request.Clone and re-factors ReverseProxy.ServeHTTP to use the new Clone method. However, the new Clone logic is not equivalent to the former logic. We preserve former semantics by explicitly allocating the Header map if nil. Fixes #33142 Change-Id: I356f94a915dd9779584ce3fe31e56e5474b9ad37 Reviewed-on: https://go-review.googlesource.com/c/go/+/186437 Run-TryBot: Joe Tsai <thebrokentoaster@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-05-17net/http/httputil: remove os.Stderr claim in ReverseProxy.ErrorLog docsDmitri Shuralyov
The motivation for doing so is to avoid making inaccurate claims. Logging may not go to os.Stderr if anyone overrides the log package's default output via https://godoc.org/log#SetOutput. Saying that the standard logger is used should be sufficient to explain the behavior, and users can infer that os.Stderr is used by default, unless it's changed. This change is the same as what was applied to http.Server.ErrorLog documentation in CL 53950. Change-Id: I32873fc548ceee573f8616b4d49b8a8b98881803 Reviewed-on: https://go-review.googlesource.com/c/go/+/176817 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-05-14net/http/httputil: remove all fields in Connection headerJonathon Lacher
In the reverseproxy, replace use (Header).Get, which returns only one value of a multiple value header, with using the Header map directly. Also fixes corresponding tests which hid the bug, and adds more tests. Fixes #30303 Change-Id: Ic9094b5983043460697748759f6dfd95fc111db7 GitHub-Last-Rev: b41038143f602d4286cb46c542d40de02e6e639d GitHub-Pull-Request: golang/go#30687 Reviewed-on: https://go-review.googlesource.com/c/go/+/166298 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-05-03net/http: add func NewRequestWithContext, Request.CloneBrad Fitzpatrick
Fixes #23544 Change-Id: Iaa31d76c4cda8ce22412d73c9025fc57e4fb1967 Reviewed-on: https://go-review.googlesource.com/c/go/+/174324 Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-04-24net/http: export Header.Clone, reduce its allocations, use it everywhereBrad Fitzpatrick
Fixes #29915 Change-Id: I6e6edf4f9a0e062211f74d120ae1a242bce1b274 Reviewed-on: https://go-review.googlesource.com/c/go/+/173658 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ingo Oeser <nightlyone@googlemail.com> Reviewed-by: Benny Siegert <bsiegert@gmail.com>
2019-03-29net/http/httputil: make ReverseProxy flush headers on FlushIntervalJordan Liggitt
A regression was introduced in CL 137335 (5440bfc) that caused FlushInterval to not be honored until the first Write() call was encountered. This change starts the flush timer as part of setting up the maxLatencyWriter. Fixes #31125 Fixes #31126 Change-Id: I75325bd926652922219bd1457b2b00ac6d0d41b0 Reviewed-on: https://go-review.googlesource.com/c/go/+/170066 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-03-11all: move internal/x to vendor/golang.org/x and revendor using 'go mod vendor'Bryan C. Mills
This also updates the vendored-in versions of several packages: 'go mod vendor' selects a consistent version of each module, but we had previously vendored an ad-hoc selection of packages. Notably, x/crypto/hkdf was previously vendored in at a much newer commit than the rest of x/crypto. Bringing the rest of x/crypto up to that commit introduced an import of golang.org/x/sys/cpu, which broke the js/wasm build, requiring an upgrade of x/sys to pick up CL 165749. Updates #30228 Updates #30241 Updates #25822 Change-Id: I5b3dbc232b7e6a048a158cbd8d36137af1efb711 Reviewed-on: https://go-review.googlesource.com/c/go/+/164623 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-01-09net/http/httputil: run the ReverseProxy.ModifyResponse hook for upgradesBrad Fitzpatrick
Fixes #29627 Change-Id: I08a5b45151a11b5a4f3b5a2d984c0322cf904697 Reviewed-on: https://go-review.googlesource.com/c/157098 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-01-09net/http/httputil: fix typo in ReverseProxy godocTobias Klauser
Change-Id: Iea33fe64403ca2e6f87a4e070af5e97d96506e41 Reviewed-on: https://go-review.googlesource.com/c/157118 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-01-02net/http/httputil: fix missing previous headers in response when switching ↵Julien Salleyron
protocol in ReverseProxy When using switching protocol, previous headers set before the reverse proxy are lost. Fixes #29407 Change-Id: Ia2b9784022d9bccef8625519ccbabbe8a276dfc0 GitHub-Last-Rev: 79bb493dcbb9b76d9d2ff9cd0854b29d634f8b73 GitHub-Pull-Request: golang/go#29408 Reviewed-on: https://go-review.googlesource.com/c/155741 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-12-03net/http/httputil: fix unannounced trailers when body is emptySALLEYRON Julien
Fix unannounced trailers when body is empty and without announced trailers. Fixes #29031 Change-Id: If49951a42fe56d4be4436a999627db4c2678659d GitHub-Last-Rev: 3469adc8f5fd977438350274134950687853a468 GitHub-Pull-Request: golang/go#29032 Reviewed-on: https://go-review.googlesource.com/c/151898 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-11-29vendor/golang_org/x: move to internal/xBryan C. Mills
Packages in vendor/ directories have a "vendor/" path prefix in GOPATH mode, but intentionally do not in module mode. Since the import path is embedded in the compiled output, changing that path invalidates cache entries and causes cmd/go to try to rebuild (and reinstall) the vendored libraries, which will fail if the directory containing those libraries is read-only. If I understood correctly, this is the approach Russ suggested as an alternative to https://golang.org/cl/136138. Fixes #27285 Fixes #26988 Change-Id: I8a2507fa892b84cde0a803aaa79e460723da572b Reviewed-on: https://go-review.googlesource.com/c/147443 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2018-11-13net/http/httputil: make ReverseProxy automatically proxy WebSocket requestsBrad Fitzpatrick
Fixes #26937 Change-Id: I6cdc1bad4cf476cd2ea1462b53444eccd8841e14 Reviewed-on: https://go-review.googlesource.com/c/146437 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2018-10-10net/http/httputil: fix race/crash in previous ReverseProxy changeBrad Fitzpatrick
The previous ReverseProxy change, CL 137335, introduced a bug which could cause a race and/or a crash. This reliably crashed before: $ go test -short -race -v -run=TestReverseProxyFlushInterval -count=20 net/http/httputil The problem was a goroutine was running http.ResponseWriter.Flush after the http.Handler's ServeHTTP completed. There was code to prevent that (a deferred stop call) but the stop call didn't consider the case where time.AfterFunc had already fired off a new goroutine but that goroutine hadn't yet scheduled. Change-Id: I06357908465a3b953efc33e63c70dec19a501adf Reviewed-on: https://go-review.googlesource.com/c/140977 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2018-10-09net/http/httputil: rewrite flushing code, disable on Server-Sent EventsBrad Fitzpatrick
* Rewrite the flushing code to not use a persistent goroutine, which also simplifies testing. * Define the meaning of a negative flush interval. Its meaning doesn't change, but now it's locked in, and then we can use it to optimize the performance of the non-buffered case to avoid use of an AfterFunc. * Support (internal-only) special casing of FlushInterval values per request/response. * For now, treat Server-Sent Event responses as unbuffered. (or rather, immediately flushed from the buffer per-write) Fixes #27816 Change-Id: Ie0f975c997daa3db539504137c741a96d7022665 Reviewed-on: https://go-review.googlesource.com/c/137335 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2018-07-13http/http/httputil: add ReverseProxy.ErrorHandlerJulien Salleyron
This permits specifying an ErrorHandler to customize the RoundTrip error handling if the backend fails to return a response. Fixes #22700 Fixes #21255 Change-Id: I8879f0956e2472a07f584660afa10105ef23bf11 Reviewed-on: https://go-review.googlesource.com/77410 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-07-09net/http/httputil: don't panic in ReverseProxy unless running under a ServerBrad Fitzpatrick
Prior to the fix to #23643, the ReverseProxy didn't panic with ErrAbortHandler when the copy to a client failed. During Go 1.11 beta testing, we found plenty of code using ReverseProxy in tests that were unprepared for a panic. Change the behavior to only panic when running under the http.Server that'll handle the panic. Updates #23643 Change-Id: Ic1fa8405fd54c858ce8c797cec79d006833a9f7d Reviewed-on: https://go-review.googlesource.com/122819 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-06-01all: update comment URLs from HTTP to HTTPS, where possibleTim Cooper
Each URL was manually verified to ensure it did not serve up incorrect content. Change-Id: I4dc846227af95a73ee9a3074d0c379ff0fa955df Reviewed-on: https://go-review.googlesource.com/115798 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2018-05-29net/http/httputil: pass through any "TE: trailers" header to backendBrad Fitzpatrick
Fixes #21096 Change-Id: I2a4688a79bdaa25b4e8ef38e3390d93d3d0bce04 Reviewed-on: https://go-review.googlesource.com/115135 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-04-04net/http/httputil: make ReverseProxy panic on error while copying bodyJames Hartig
Fixes #23643. Change-Id: I4f8195a36be817d79b9e7c61a5301f153b681493 Reviewed-on: https://go-review.googlesource.com/91675 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-20net/http: use RFC 723x as normative reference in docsDavid Url
Replace references to the obsoleted RFC 2616 with references to RFC 7230 through 7235, to avoid unnecessary confusion. Obvious inconsistencies are marked with todo comments. Updates #21974 Change-Id: I8fb4fcdd1333fc5193b93a2f09598f18c45e7a00 Reviewed-on: https://go-review.googlesource.com/94095 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-01-06Revert "net/http/httputil: allow ReverseProxy to call ModifyResponse on ↵Brad Fitzpatrick
failed requests" This reverts commit https://golang.org/cl/54030 Reason for revert: to not paint ourselves into a corner. See https://github.com/golang/go/issues/23009 Fixes #23009 Updates #21255 Change-Id: I68caab078839b9d2bf645a7bbed8405a5a30cd22 Reviewed-on: https://go-review.googlesource.com/86435 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-11-14net/http/httputil: allow ReverseProxy to call ModifyResponse on failed requestsAkhil Indurti
Previously when RoundTrip returned a non-nil error, the proxy returned a StatusBadGateway error, instead of first calling ModifyResponse. This commit first calls ModifyResponse, whether or not the error returned from RoundTrip is nil. Also closes response body when ModifyResponse returns an error. See #22658. Fixes #21255 Change-Id: I5b5bf23a69ae5608f87d4ece756a1b4985ccaa9c Reviewed-on: https://go-review.googlesource.com/54030 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-11-11net/http/httputil: make ReverseProxy close response body if ModifyResponse ↵Edan B
returns an error Fixes #22658 Change-Id: I00e2b007d77b6f54798f7755d0b08e4fea824392 Reviewed-on: https://go-review.googlesource.com/77170 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-10-16net/http/httputil: extract duplicate code as removeConnectionHeadersKunpei Sakai
Change-Id: I50389752dcbf5d058ce11256a414be7955cdb77f Reviewed-on: https://go-review.googlesource.com/71070 Run-TryBot: Tom Bergan <tombergan@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tom Bergan <tombergan@google.com>
2017-06-26net/http/httputil: always deep copy the Request.Header map in ReverseProxyBrad Fitzpatrick
We used to do it sometimes as an optimization, but the optimization is flawed: in all non-contrived cases we need to deep clone the map anyway. So do it always, which both simplifies the code but also fixes the X-Forward-For value leaking to the caller's Request, as well as modifications from the optional Director func. Fixes #18327 Change-Id: I0c86d10c557254bf99fdd988227dcb15f968770b Reviewed-on: https://go-review.googlesource.com/46716 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-05-22net/http/httputil: ReverseProxy should pass on unannounced TrailersTristan Colgate
Trailers that are not announced in the Trailer must be passed on to the downstream client. Rather than iterate over each and find missing trailer values, this re-adds all trailers to the headers if there is a disparity between the number of announced trailers and the final number. This fixes #20437 Change-Id: I867e85f45feff68616a9a9bd6f65f12d73825eb7 Reviewed-on: https://go-review.googlesource.com/43712 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-02-06net/http/httputil: don't log read error when it's context.CanceledSameer Ajmani
Fixes #18838 Change-Id: I44976cadb0dc3c23eacb8cdd58429a572cd8d28a Reviewed-on: https://go-review.googlesource.com/36358 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-02-01net/http/httputil: eliminate duplicate alloc/copy in ReverseProxyBlake Mizerany
This commit elimates the request allocation and shallow copy duplication already done by req.WithContext. name old time/op new time/op delta ServeHTTP-4 216µs ±36% 212µs ±15% ~ (p=0.853 n=10+10) name old alloc/op new alloc/op delta ServeHTTP-4 917kB ±36% 1137kB ± 0% ~ (p=0.352 n=10+10) name old allocs/op new allocs/op delta ServeHTTP-4 5.00 ± 0% 4.00 ± 0% -20.00% (p=0.000 n=10+10) Change-Id: I514a59c30b037c7a65c355b06fd82c2d6ff17bb0 Reviewed-on: https://go-review.googlesource.com/35569 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-12-29net/http/httputil: clarify the contract on ReverseProxy's Director.Mike Wiacek
Avoid potential race conditions by clarifying to implemntors of the ReverseProxy interface, the lifetime of provided http.Request structs. Fixes #18456 Change-Id: I46aa60322226ecc3a0d30fa1ef108e504171957a Reviewed-on: https://go-review.googlesource.com/34720 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-11-01net/http/httputil: add ModifyResponse to reverseProxyEmmanuel Odeke
Adds ModifyResponse, an optional func to ReverseProxy that modifies a response in the backend, right before the headers of the response are written to the internal response writer. If ModifyResponse returns an error, the proxy returns a StatusBadGateway error. Fixes #14237. Change-Id: I8e03139e34dea0084512ccbd8cc49e941bf9fb5d Reviewed-on: https://go-review.googlesource.com/32356 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-10-24net/http/httputil: log err encountered during reverseproxy body copyingMichael Fraenkel
Fixes #16659 Change-Id: I13dd797e93e0b572eaf8726f1be594870d40183b Reviewed-on: https://go-review.googlesource.com/30692 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-09-26net/http/httputil: preallocate trailerKeys sliceGyu-Ho Lee
To prevent slice growths with append operations. Change-Id: Icdb745b23cc44dfaf3e16746b94c06997f814e15 Reviewed-on: https://go-review.googlesource.com/23784 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-09-08net/http/httputil: remove custom hop-by-hop headers from response in ↵Sina Siadat
ReverseProxy Hop-by-hop headers (explicitly mentioned in RFC 2616) were already removed from the response. This removes the custom hop-by-hop headers listed in the "Connection" header of the response. Updates #16875 Change-Id: I6b8f261d38b8d72040722f3ded29755ef0303427 Reviewed-on: https://go-review.googlesource.com/28810 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-09-08net/http/httputil: copy header map if necessary in ReverseProxySina Siadat
We were already making a copy of the map before removing hop-by-hop headers. This commit does the same for proxied headers mentioned in the "Connection" header. A test is added to ensure request headers are not modified. Updates #16875 Change-Id: I85329d212787958d5ad818915eb0538580a4653a Reviewed-on: https://go-review.googlesource.com/28493 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2016-09-02net/http/httputil: make ReverseProxy send nil Body requests when possibleBrad Fitzpatrick
The http.Transport's retry can't retry requests with non-nil bodies. When cloning an incoming server request into an outgoing client request, nil out the Body field if the ContentLength is 0. (For server requests, Body is always non-nil, even for GET, HEAD, etc.) Also, don't use the deprecated CancelRequest and use Context instead. And don't set Proto, ProtoMajor, ProtoMinor. Those are ignored in client requests, which was probably a later documentation clarification. Fixes #16036 Updates #16696 (remove useless Proto lines) Change-Id: I70a869e9bd4bf240c5838e82fb5aa695a539b343 Reviewed-on: https://go-review.googlesource.com/28412 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 08:39:31 +0000