27 lines
761 B
Go
27 lines
761 B
Go
|
package web
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"net"
|
|||
|
|
"net/http"
|
|||
|
|
"strings"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// requestIsHTTPS 识别直连 TLS，或仅信任本机反向代理传入的 HTTPS 标记。
|
|||
|
|
// Admin 生产进程只监听 127.0.0.1，Nginx 在同机终止 TLS；不能无条件信任
|
|||
|
|
// X-Forwarded-Proto，否则直接访问端口的客户端可以伪造安全来源。
|
|||
|
|
func requestIsHTTPS(request *http.Request) bool {
|
|||
|
|
if request.TLS != nil {
|
|||
|
|
return true
|
|||
|
|
}
|
|||
|
|
host, _, err := net.SplitHostPort(request.RemoteAddr)
|
|||
|
|
if err != nil {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
remoteIP := net.ParseIP(host)
|
|||
|
|
if remoteIP == nil || !remoteIP.IsLoopback() {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
forwardedProto := strings.TrimSpace(strings.Split(request.Header.Get("X-Forwarded-Proto"), ",")[0])
|
|||
|
|
return strings.EqualFold(forwardedProto, "https")
|
|||
|
|
}
|