Ensure we are properly handling hop-by-hop headers

boringproxy / boringproxy

Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.

MIT License

1.16k stars 108 forks source link

Ensure we are properly handling hop-by-hop headers #124

Open anderspitman opened 2 years ago

anderspitman commented 2 years ago

https://book.hacktricks.xyz/pentesting-web/abusing-hop-by-hop-headers

Currently we rather naively copy all headers from the downstream request. I would guess most of the hop-by-hop headers are already correctly being overwritten by Go's HTTP client, but maybe not.

anderspitman commented 2 years ago

This is somewhat mitigated in v0.9.0. By using Client TLS tunnels, the raw TCP stream goes all the way to the upstream server. so hop-by-hop is bypassed. Would still be nice to have this for HTTPS tunnels though.