bzp2010 commented on code in PR #13939:
URL: https://github.com/apache/apisix/pull/13939#discussion_r4022343820
##########
apisix/init.lua:
##########
@@ -330,6 +346,46 @@ local function set_upstream_headers(api_ctx, picked_server)
end
+-- hop-by-hop headers, plus handshake headers connect() already sets itself
+-- (host/protocols/origin opts, or generated Sec-WebSocket-Key/-Version).
+local ws_skip_forward_headers = {
+ ["host"] = true,
+ ["connection"] = true,
+ ["upgrade"] = true,
+ ["keep-alive"] = true,
+ ["te"] = true,
+ ["trailers"] = true,
+ ["proxy-authenticate"] = true,
+ ["proxy-authorization"] = true,
+ ["content-length"] = true,
+ ["transfer-encoding"] = true,
+ ["sec-websocket-key"] = true,
+ ["sec-websocket-version"] = true,
+ ["sec-websocket-extensions"] = true,
+ ["sec-websocket-protocol"] = true,
+ ["origin"] = true,
+}
+
+
+-- forwards the client's other headers (Cookie, Authorization, ...) upstream.
+local function build_ws_forward_headers(api_ctx)
Review Comment:
This is an issue; I’ll look into it. I believe it’s essential to ensure that
the XFF security requirements for the new WS proxy path are the same as those
for the standard proxy path; they must use a single implementation rather than
being reimplemented specifically for WS.
The existing hop-by-hop filtering must be reimplemented because this logic
is traditionally implemented in Nginx’s native code and cannot be replicated.
We are now using `content_by_lua` instead of the proxy module.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
