Re: internal vs. external hostname in Request.getHost9)
Glyph Lefkowitz <[email protected]> Mon, 20 Mar 2017 23:09:33 -0700
| Newsgroups | gmane.comp.python.twisted.web |
|---|---|
| Message-ID | <[email protected]> |
--===============7419132110830845013== Content-Type: multipart/alternative; boundary="Apple-Mail=_06D66CB3-096A-44CB-AF82-AE3D67BA29A6" --Apple-Mail=_06D66CB3-096A-44CB-AF82-AE3D67BA29A6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Mar 20, 2017, at 11:30 AM, Tom Most <[email protected]> wrote: >=20 > If Twisted is to support this in any way, I think that it should be = opt-in support for the Forwarded header as specified in RFC 7239. This = should be a parameter applicable to all of twisted.web.server rather = than per-method call, since it's something the administrator needs to = set. >=20 I'm generally in agreement with this. Further, we should probably have = some notion of authentication, i.e. Site(..., = trustForwardedForFrom=3D[...]), where [...] could be, let's say a = twisted.internet.ssl.Certificate representing a client CA to check = client connections from, or a list of = twisted.internet.address.IPv4Address objects naming servers on a network = we can trust. Effectively building in authentication to this layer is = important (and since twisted is a web _server_ and not a web framework, = more generally possible than e.g. Django). -glyph= --Apple-Mail=_06D66CB3-096A-44CB-AF82-AE3D67BA29A6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On Mar 20, 2017, at 11:30 AM, Tom Most <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = style=3D"font-family: Menlo-Regular; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; orphans: auto; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: auto; word-spacing: = 0px; -webkit-text-stroke-width: 0px;" class=3D"">If Twisted is to = support this in any way, I think that it should be opt-in support for = the Forwarded header as specified in RFC 7239. This should be a = parameter applicable to all of twisted.web.server rather than per-method = call, since it's something the administrator needs to set.<br = class=3D""></div><br = class=3D"Apple-interchange-newline"></div></blockquote></div><br = class=3D""><div class=3D"">I'm generally in agreement with this. = Further, we should probably have some notion of authentication, = i.e. Site(..., trustForwardedForFrom=3D[...]), where [...] could be, = let's say a twisted.internet.ssl.Certificate representing a client CA to = check client connections from, or a list of = twisted.internet.address.IPv4Address objects naming servers on a network = we can trust. Effectively building in authentication to this layer = is important (and since twisted is a web _server_ and not a web = framework, more generally possible than e.g. Django).</div><div = class=3D""><br class=3D""></div><div class=3D"">-glyph</div></body></html>= --Apple-Mail=_06D66CB3-096A-44CB-AF82-AE3D67BA29A6-- --===============7419132110830845013== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Twisted-web mailing list [email protected] http://twistedmatrix.com/cgi-bin/mailman/listinfo/twisted-web --===============7419132110830845013==--