photos/cmd/proxy/proxy.go

// This is honestly terrible
package main

import (
	"io"
	"log"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"github.com/miekg/dns"
)

var endpoint string
var endpointSecure bool
var behindProxy bool
var client *http.Client

func main() {
	// Read configuration
	endpoint = os.Getenv("MINIO_ENDPOINT")
	endpointSecure = os.Getenv("MINIO_ENDPOINT_SECURE") == "true"
	behindProxy = os.Getenv("BEHIND_PROXY") == "true"

	// Setup HTTP client
	transport := &http.Transport{
		MaxIdleConns:        4,
		MaxIdleConnsPerHost: 4,
		IdleConnTimeout:     30 * time.Second,
		DisableCompression:  true,
	}
	client = &http.Client{
		Transport: transport,
		Timeout:   5 * time.Second,
	}

	server := &http.Server{
		Addr:         ":80",
		ReadTimeout:  5 * time.Second,
		WriteTimeout: 10 * time.Second,
		Handler:      http.HandlerFunc(handle),
	}
	err := server.ListenAndServe()
	if err != nil {
		panic(err)
	}
}

func handle(w http.ResponseWriter, r *http.Request) {
	// Validate host
	if _, ok := dns.IsDomainName(r.Host); !ok {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	// Rewrite URL
	path := mapPath(r.URL.Path, r.Host)
	url := &url.URL{
		Scheme: "http",
		Host:   endpoint,
		Path:   path,
	}
	if endpointSecure {
		url.Scheme = "https"
	}

	// Update Forwarded headers
	header := safeCloneHeader(r.Header)

	// Create forwarded request
	out := &http.Request{
		URL:    url,
		Header: header,
	}

	log.Println(out.URL)
	resp, err := client.Do(out)
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		log.Println(err)
		return
	}
	defer resp.Body.Close()

	w.WriteHeader(resp.StatusCode)
	io.Copy(w, resp.Body)
}

func mapPath(path, host string) string {
	if strings.HasSuffix(path, "/") {
		path += "index.html"
	}
	return "/" + host + path
}

// Further validation is required for this function
func safeCloneHeader(h http.Header) http.Header {
	clone := make(http.Header, 0)
	for key, value := range h {
		if !safeHeaderName(key) {
			continue
		}
		for _, v := range value {
			clone.Add(key, v)
		}
	}
	return clone
}

// Comparisons in this function MUST be in canonical form
func safeHeaderName(name string) bool {
	if behindProxy {
		if name == "X-Forwarded-For" {
			return true
		}
		if name == "X-Forwarded-Host" {
			return true
		}
		if name == "X-Forwarded-Proto" {
			return true
		}
		if name == "Forwarded" {
			return true
		}
	}
	return false
}