Add a new field ProbeResistanceAuthExternal that allows probe_resistance
to work without auth_credentials configured in forwardproxy itself.
This enables setups where authentication is handled externally (e.g. via
Caddy's forward_auth directive placed before forward_proxy in the route
order).
- New field: ProbeResistanceAuthExternal (bool)
- Provision() now skips the probe_resistance requires authentication
check when this flag is set
- Mutually exclusive with auth_credentials
- Caddyfile subdirective: probe_resistance_auth_external
This also in some sense mitigates DoS attacks by flooding servers with a lot of denied hostnames, which could lead to overloading the DNS services.
Co-authored-by: Juan Calderon-Perez <835733+gaby@users.noreply.github.com>
All the tests pass. I tried to keep as much as possible the same, but a
few things don't translate well to Caddy 2, notably one test in
probe_resist_test.go on L200, I had to change that test case since I
didn't quite understand why it was the way it was before.
Does not yet have v2 Caddyfile support.
In #53 we added a realm to the Proxy-Authenticate header, but the realm
only is added, when `probe_resistance` is off.
With this change, Proxy-Authenticate header will have a realm
when `probe_resistance` is on as well.
We stopped parsing hostname from Host field, this fixes it back.
Implicit port 80 is good not only for GET, so I changed the logic to try
port 80 on all non-connects.
While testing, I also realized that switchy omega doesn't actually presend credentials,
(somehow I thought it did), so I removed a link to it from the README.md to avoid
confusion.
Fixes#36
We settled on a powerful, but a bit complicated acl design.
This commit makes a couple of cosmetic improvements. It also removes
http.Transport, which was previously used to dial and write http
requests for insecure GET requests. Now we have to dial manually,
so we can check the access control list.
Fixes: abnormal ContentLength; empty schema due to the out of position check.
Handling of HTTP GET requests: original request and URL are now reused. `generateForwardRequest()` is removed for simplicity.
