Improve proxy security (#100)

[toplenboren]

Fixes #100

I added some small improvements to proxy.ts service

I've implemented:

• Do not allow POST / PUT and pretty much everything besides GET
• Do not allow requests to reserved ips
• Do not allow anything besides http or https
• Remove shady headers
• Added a handy README note
• Test that init real target http server and proxy and test end to end user

I asked a few questions in #100. Let's use issue to discuss planned changes

Motivation

We do not want our proxy to be abused and banned, thus all the security stuff. Check #100 for details

Deps

I needed a package to check whether IP is reserved or not. Thought that we do not want to bloat our code with this stuff. I found three packages: isMartianPacket, bogon and isReservedIp

I found is-reserved-ip code to be strange and bogon to have one more dependency 👍

I decided to pick isMartianPacket.Package seems to be maintained, and I found the lack of types (Can implement this myself 🥨) and lack of adoption as main drawback (thou need to say that many people just introduce code for this task in their projects).

Checklist (Gonna be checked once we are out of draft state)

• [x] Don’t rush. Check all changes in PR again.
• [x] Run pnpm test.
• [x] Think about changing documentation.
  • If you added a script to scripts/, add a comment with a description.
  • If you added a new folder, add its description to the project’s README.md.
  • If you added config, describe how we use this tool in the config’s comment.
  • If you added something to the project’s architecture, describe it in the project’s README.md.
  • Try to focus on “why?”, not “how?”.
• [x] If you added a new dependency, check our requirements.
• [x] Think about testing
  • If you added a feature, add unit tests.
  • If you added a new state to the UI, add visual tests.
  • If you fixed the bug, think about preventing bug regression in the future.
• If you changed web client:
  • [x] Think about moving code to core/. What code will also be useful on other platforms?
  • [x] Run pnpm size and check the difference in the JS bundle size. Is it relevant to the changes? Change the limit in web/.size-limit.json if necessary.
  • [x] Think about keyboard UX. Is it easy to use the new feature with only one hand on a keyboard? Is it easy to understand what keys to press?
  • [x] Think about HTML semantics.
  • [x] Think about accessibility. Check a11y recommendations. Think about how screen reader users will use the tool. Is it easy to use on a screen with bad contrast?
  • [x] Think about translations. Will
  • [x] Think about right-to-left languages. What parts of the screen should be mirrored for Arabic or Hebrew languages?
• If you changed the colors token in the web client:
  • [x] Think about app loading styles inlined in index.html.
• If you changed core/:
  • [x] Think about making types more precise. Can you better explain data relations by type?
  • [x] Think about conflict resolution. We don’t need some very smart changing merging; just 2 changes of the same item on different clients should not break the database. What if the user changes an item on one machine and removes it on another?
  • [x] Think about log and storage migration.
• If you changed English translations:
  • [x] Change translation ID if you change the meaning of the text.

[toplenboren]

Hey, @ai I've done some cool stuff! Can you please re-review my PR?

Done:

• Introduced timeout feature
• Refactored error handling: All Bad Requests will not be looged and will return 400 to user
• Fixed minor issues, such as README.md structure or typescript errors

Questions:

• I have a question about single describe in tests. Please check it
• I have a question about configuration

Left to do:

1. Debounce
2. Hide client IP
3. Limit size of response
4. Introduce partial return for optimizations

[ai]

I am merging this because I need it for other task