Re: internal vs. external hostname in Request.getHost9)
Glyph <[email protected]> Fri, 17 Mar 2017 01:16:27 -0700
| Newsgroups | gmane.comp.python.twisted.web |
|---|---|
| Message-ID | <[email protected]> |
--===============3706615037116501623== Content-Type: multipart/alternative; boundary="Apple-Mail=_3541DA31-8AE4-47FB-9108-DF3D4FCA507E" --Apple-Mail=_3541DA31-8AE4-47FB-9108-DF3D4FCA507E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Mar 15, 2017, at 1:20 AM, Ilya Skriblovsky = <[email protected]> wrote: >=20 > Ok, so in the sort term you are suggesting to change Request.URLPath Yes. > (uppercased method? Hmm) Like I said, not a great interface, overall :-). > to use Host header instead of getRequestHostname and to change Klein = to use it instead of Request.getHost(), right? > Sounds wise and reasonable :) OK, glad you agree :). > But I'd like to add one more thing. In order to build correct external = URL we need to know is it http or https. Currently URLPath is using = Request.isSecure(), but it is not sufficient since Request.isSecure() = just checks if backend connection is SSL while encryption is often = terminated at a reverse proxy. Can we add "useXForwardedProto=3DFalse" = argument to Request.URLPath() and check X-Forwarded-Proto header if it = is true? And may be add "useXForwardedHost=3DFalse" too to simplify = setting up a reverse proxy (with a bold red warning in docstring that it = can be set to True only if reverse proxy is correctly configured to drop = corresponding client-specified headers). What do you think? I think that for starters, it would make more sense to just fix it to = always honor forwarded-for and x-forwarded-for headers. The code = calling request.URLPath(), in a given Resource, or application, is = highly unlikely to know whether it wants to honor (x-)forwarded-for. = The code that might know about this sort of configuration would be the = thing that constructs the Site object, but I'd be much happier to just = get a change that always honors it first, and then figure out how to = customize it later. -glyph --Apple-Mail=_3541DA31-8AE4-47FB-9108-DF3D4FCA507E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On Mar 15, 2017, at 1:20 AM, Ilya Skriblovsky <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">Ok, so in the sort term you are suggesting to change = Request.URLPath</div></div></blockquote><div><br = class=3D""></div><div>Yes.</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""> (uppercased = method? Hmm)</div></div></blockquote><div><br class=3D""></div><div>Like = I said, not a great interface, overall :-).</div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""> to use Host header instead of getRequestHostname = and to change Klein to use it instead of Request.getHost(), right?<div = class=3D"">Sounds wise and reasonable = :)</div></div></div></blockquote><div><br class=3D""></div><div>OK, glad = you agree :).</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div dir=3D"ltr" class=3D""><div class=3D"">But I'd like to = add one more thing. In order to build correct external URL we need to = know is it http or https. Currently URLPath is using Request.isSecure(), = but it is not sufficient since Request.isSecure() just checks if backend = connection is SSL while encryption is often terminated at a reverse = proxy. Can we add "useXForwardedProto=3DFalse" argument to = Request.URLPath() and check X-Forwarded-Proto header if it is true? And = may be add "useXForwardedHost=3DFalse" too to simplify setting up a = reverse proxy (with a bold red warning in docstring that it can be set = to True only if reverse proxy is correctly configured to drop = corresponding client-specified headers). What do you = think?</div></div></blockquote><br class=3D""></div><div>I think that = for starters, it would make more sense to just fix it to <i = class=3D"">always</i> honor forwarded-for and x-forwarded-for headers. = The code calling request.URLPath(), in a given Resource, or = application, is highly unlikely to know whether it wants to honor = (x-)forwarded-for. The code that might know about this sort of = configuration would be the thing that constructs the Site object, but = I'd be much happier to just get a change that always honors it first, = and then figure out how to customize it later.</div><div><br = class=3D""></div><div>-glyph</div><div><br class=3D""></div></body></html>= --Apple-Mail=_3541DA31-8AE4-47FB-9108-DF3D4FCA507E-- --===============3706615037116501623== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Twisted-web mailing list [email protected] http://twistedmatrix.com/cgi-bin/mailman/listinfo/twisted-web --===============3706615037116501623==--