X-Forwarded-For results from the CPAN

X-Forwarded-For

Mojolicious

view release on metacpan or search on metacpan

lib/Mojo/Server/Hypnotoad.pm view on Meta::CPAN


  pid_file => '/var/run/hypnotoad.pid'

Full path to process id file, defaults to C<hypnotoad.pid> in the same directory as the application. Note that this
value can only be changed after the server has been stopped.

=head2 proxy

  proxy => 1

Activate reverse proxy support, which allows for the C<X-Forwarded-For> and C<X-Forwarded-Proto> headers to be picked
up automatically, defaults to the value of L<Mojo::Server/"reverse_proxy">.

=head2 requests

  requests => 50

Number of keep-alive requests per connection, defaults to the value of L<Mojo::Server::Daemon/"max_requests">.

=head2 spare

lib/Mojo/Transaction.pm view on Meta::CPAN


sub is_websocket {undef}

sub remote_address {
  my $self = shift;

  return $self->original_remote_address(@_) if @_;
  return $self->original_remote_address unless $self->req->reverse_proxy;

  # Reverse proxy
  my @addrs   = split /\s*,\s*/, ($self->req->headers->header('X-Forwarded-For') // '');
  my $trusted = $self->req->trusted_proxies;
  return @addrs ? $addrs[-1] : $self->original_remote_address unless @$trusted;

  push @addrs, $self->original_remote_address;
  for my $addr (reverse @addrs) {
    return $addr unless any { network_contains($_, $addr) } @$trusted;
  }
  return $addrs[0];
}

lib/Mojo/Transaction.pm view on Meta::CPAN

  my $bool = $tx->is_websocket;

False, this is not a L<Mojo::Transaction::WebSocket> object.

=head2 remote_address

  my $address = $tx->remote_address;
  $tx         = $tx->remote_address('127.0.0.1');

Same as L</"original_remote_address"> unless L</"req"> has been performed via a L<Mojo::Message::Request/reverse_proxy>.
If so then the last value of C<X-Forwarded-For> header is returned. Additionally if
L<Mojo::Message::Request/trusted_proxies> are also provided then the original address must be trusted and any
C<X-Forwarded-For> entries that are trusted are ignored, returning the last untrusted address or the first address if
all are trusted.

=head2 result

  my $res = $tx->result;

Returns the L<Mojo::Message::Response> object from L</"res"> or dies if a connection error has occurred.

  # Fine grained response handling (dies on connection errors)
  my $res = $tx->result;

lib/Mojolicious/Guides/Cookbook.pod view on Meta::CPAN

  };

But one of its biggest advantages is the support for effortless zero downtime software upgrades (hot deployment). That
means you can upgrade L<Mojolicious>, Perl or even system libraries at runtime without ever stopping the server or
losing a single incoming connection, just by running the command above again.

  $ hypnotoad ./script/my_app
  Starting hot deployment for Hypnotoad server 31841.

You might also want to enable proxy support if you're using L<Hypnotoad|Mojo::Server::Hypnotoad> behind a reverse
proxy. This allows L<Mojolicious> to automatically pick up the C<X-Forwarded-For> and C<X-Forwarded-Proto> headers.

  # myapp.conf
  {hypnotoad => {proxy => 1}};

To manage L<Hypnotoad|Mojo::Server::Hypnotoad> with systemd, you can use a unit configuration file like this.

  [Unit]
  Description=My Mojolicious application
  After=network.target

lib/Mojolicious/Guides/Cookbook.pod view on Meta::CPAN

  }
  server {
    listen 80;
    server_name localhost;
    location / {
      proxy_pass http://myapp;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  }

=head2 Apache/mod_proxy

Another good reverse proxy is L<Apache|https://httpd.apache.org> with C<mod_proxy>, the configuration looks quite
similar to the Nginx one above. And if you need WebSocket support, newer versions come with C<mod_proxy_wstunnel>.

  <VirtualHost *:80>

lib/Mojolicious/Guides/Cookbook.pod view on Meta::CPAN

and Ruby's Rack. L<Mojolicious> applications are ridiculously simple to deploy with L<Plack>, but be aware that many
real-time web features, such as WebSockets, are not available.

  $ plackup ./script/my_app

L<Plack> provides many server and protocol adapters for you to choose from, such as C<FCGI>, C<uWSGI> and C<mod_perl>.

  $ plackup ./script/my_app -s FCGI -l /tmp/myapp.sock

The C<MOJO_REVERSE_PROXY> environment variable can be used to enable proxy support, this allows L<Mojolicious> to
automatically pick up the C<X-Forwarded-For> and C<X-Forwarded-Proto> headers.

  $ MOJO_REVERSE_PROXY=1 plackup ./script/my_app

If an older server adapter is unable to correctly detect the application home directory, you can simply use the
C<MOJO_HOME> environment variable.

  $ MOJO_HOME=/home/sri/my_app plackup ./script/my_app

There is no need for a C<.psgi> file, just point the server adapter at your application script, it will automatically
act like one if it detects the presence of a C<PLACK_ENV> environment variable.

t/mojo/request.t view on Meta::CPAN

  is $req->headers->content_length, 27,                           'right "Content-Length" value';
};

subtest 'Parse full HTTP 1.0 request (behind reverse proxy)' => sub {
  my $req = Mojo::Message::Request->new;
  $req->parse('GET /foo/bar/baz.html?fo');
  $req->parse("o=13 HTTP/1.0\x0d\x0aContent");
  $req->parse('-Type: text/');
  $req->parse("plain\x0d\x0aContent-Length: 27\x0d\x0a");
  $req->parse("Host: mojolicious.org\x0d\x0a");
  $req->parse("X-Forwarded-For: 192.168.2.1, 127.0.0.1\x0d\x0a\x0d\x0a");
  $req->parse("Hello World!\n1234\nlalalala\n");
  ok $req->is_finished, 'request is finished';
  is $req->method,                  'GET',                                            'right method';
  is $req->version,                 '1.0',                                            'right version';
  is $req->url,                     '/foo/bar/baz.html?foo=13',                       'right URL';
  is $req->url->to_abs,             'http://mojolicious.org/foo/bar/baz.html?foo=13', 'right absolute URL';
  is $req->headers->content_type,   'text/plain',                                     'right "Content-Type" value';
  is $req->headers->content_length, 27,                                               'right "Content-Length" value';
};

t/mojolicious/lite_app.t view on Meta::CPAN

# Root with format
$t->get_ok('/.html')
  ->status_is(200)
  ->header_exists_not('Servers')
  ->header_exists_not('Servers', 'the header is missing')
  ->header_exists('Server')
  ->header_exists('Server', 'the header exists')
  ->header_is(Server => 'Mojolicious (Perl)')
  ->content_is("/root.html\n/root.html\n/root.html\n/root.html\n/root.html\n");

subtest 'Reverse proxy with "X-Forwarded-For"' => sub {
  local $ENV{MOJO_REVERSE_PROXY} = 1;
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.1/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-192\.0\.2\.1-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-For" and trusted proxies' => sub {
  local $ENV{MOJO_TRUSTED_PROXIES} = '127.0.0.1, 192.0.2.1';
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.(?:2|1)/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-192\.0\.2\.2-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-For" and trusted proxies (untrusted original)' => sub {
  local $ENV{MOJO_TRUSTED_PROXIES} = '192.0.2.1';
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.(?:2|1)/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-127\.0\.0\.1-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-For" and trusted proxy networks' => sub {
  local $ENV{MOJO_TRUSTED_PROXIES} = '127.0.0.0/8, 192.0.2.1/32';
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.(?:2|1)/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-192\.0\.2\.2-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-For" and trusted proxies (all addresses trusted)' => sub {
  local $ENV{MOJO_TRUSTED_PROXIES} = '0.0.0.0/0';
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.(?:2|1)/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-192\.0\.2\.2-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-For" and trusted proxies (unexpected leading address)' => sub {
  local $ENV{MOJO_TRUSTED_PROXIES} = '127.0.0.0/8, 192.0.2.1';
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-For' => '7.7.7.7, 192.0.2.2, 192.0.2.1'})
    ->status_is(200)
    ->header_unlike('X-Original' => qr/192\.0\.2\.(?:2|1)/)
    ->content_like(qr!http://127\.0\.0\.1:\d+/0-192\.0\.2\.2-0$!);
};

subtest 'Reverse proxy with "X-Forwarded-Proto"' => sub {
  local $ENV{MOJO_REVERSE_PROXY} = 1;
  my $t = Test::Mojo->new;
  $t->get_ok('/0' => {'X-Forwarded-Proto' => 'https'})
    ->status_is(200)
    ->content_like(qr!^https://127\.0\.0\.1:\d+/0-!)
    ->content_like(qr/-0$/)
    ->content_unlike(qr!-192\.0\.2\.1-0$!);
};

# "X-Forwarded-For"
$t->ua->server->restart;
$t->get_ok('/0' => {'X-Forwarded-For' => '192.0.2.2, 192.0.2.1'})
  ->status_is(200)
  ->content_like(qr!^http://127\.0\.0\.1:\d+/0-!)
  ->content_like(qr/-0$/)
  ->content_unlike(qr!-192\.0\.2\.1-0$!);

# "X-Forwarded-Proto"
$t->get_ok('/0' => {'X-Forwarded-Proto' => 'https'})
  ->status_is(200)
  ->content_like(qr!^http://127\.0\.0\.1:\d+/0-!)
  ->content_like(qr/-0$/)

( run in 0.273 second using v1.01-cache-2.11-cpan-3cd7ad12f66 )