feat: 准备 Admin 线上 HTTPS 部署 (#81)

admin/handler/web/proxy.go

@@ -0,0 +1,26 @@
+package web
+
+import (
+	"net"
+	"net/http"
+	"strings"
+)
+
+// requestIsHTTPS 识别直连 TLS，或仅信任本机反向代理传入的 HTTPS 标记。
+// Admin 生产进程只监听 127.0.0.1，Nginx 在同机终止 TLS；不能无条件信任
+// X-Forwarded-Proto，否则直接访问端口的客户端可以伪造安全来源。
+func requestIsHTTPS(request *http.Request) bool {
+	if request.TLS != nil {
+		return true
+	}
+	host, _, err := net.SplitHostPort(request.RemoteAddr)
+	if err != nil {
+		return false
+	}
+	remoteIP := net.ParseIP(host)
+	if remoteIP == nil || !remoteIP.IsLoopback() {
+		return false
+	}
+	forwardedProto := strings.TrimSpace(strings.Split(request.Header.Get("X-Forwarded-Proto"), ",")[0])
+	return strings.EqualFold(forwardedProto, "https")
+}