google / sxg-rs

A set of tools for generating signed exchanges at serve time.
Apache License 2.0
83 stars 20 forks source link

Error out if `via: sxgrs` #394

Closed twifkak closed 1 year ago

twifkak commented 1 year ago

This code sets or modifies Via to include sxgrs.

We should add code to error out (not even proxy unsigned) if the incoming request contains sxgrs. This is an indication of what is likely an infinite network loop. (This is a defense in depth against an error that is unlikely to occur in practice because the only forwarded request headers are user-agent, via, and whatever's listed in the forward_header_names config.).