#Get the requested host address

25 messages · Page 1 of 1 (latest)

crimson lark
#

I have service which is hosted on let's say www.xyz.com.
Now I have a front end which is hosted on www.abc.com, it is calling the backend www.xyz.com via a proxy.

Internally in the service www.xyz.com I calling a third party API. This API should only be called if it is coming from www.abc.com.
When I checked the http.Request, r.Host, I am seeing the host to be www.xyz.com, rather than abc.com.

How to check the host name from where it is coming?

Thanks

brazen trail
#

Requests don't really come from a host, they come from an IP address.

#

The host mentioned in the request is the host the request is made to, as you can see. That is so several hostnames can point on the same IP, and the server receiving the request will still be able to determine what resource is being requested.

hollow gulch
brazen trail
#

You can look up hosts associated with an IP address, but if you are looking to whitelist requests only from a specific host, it's better to do so by IP address directly.

#

Any header is set by the client, and as such, easily faked.

crimson lark
#

@hollow gulch , I think you are right, origin header ?

crimson lark
crimson lark
brazen trail
#

req.RemoteAddr if it is not proxied at all.

#

If you have a remote proxy in front, it needs to set a header.

#

Though you need to make sure the reverse proxy will set that header every time, even if it's already set by the client.

crimson lark
#

There is the origin key in header just like @hollow gulch mentioned. Is that a good solution @brazen trail ?

brazen trail
#

Depends on how the header gets into the request. If it's set by the client, the client can set whatever they want.

hollow gulch
#

Yeah you shouldn't rely 100% on it

crimson lark
#

so req.RemoteAddr is the 100% sure thing?

brazen trail
#

It depends. It always depends.

#

If you are behind a reverse proxy, req.RemoteAddr is the address of that proxy.

#

A reverse proxy could be a load balancer, a TLS wrapper, or whatever else.

#

If you are accepting connections directly from the "raw" internet, then req.RemoteAddr is the actual requesting client's IP address, yes.

#

For example, I host a lot of different little hobby projects off the same VPS, so they all have the same IP address and port. To differentiate between them, I use an nginx reverse proxy in front of them.

crimson lark
#

what are the other way we can set up header origin? if not by client?

brazen trail
#

By a proxy.

#

It is customary for a reverse proxy to set the header X-Forwarded-For when forwarding the request.