secureurl

Documentation

Overview

Package secureurl holds one rule, in one place: where a bearer token may be sent.

CLANKERBAR_API_KEY is ACCOUNT-scoped — it covers every project the operator is a member of. CLA-257 was the account key being sent to a host named by a file inside the workdir, over plain http. The destination is now pinned by config (see internal/config), and the scheme floor lives here because three packages need the same answer: config, when it decides what a config file may say, and backlog + plane, when a redirect tries to move a request that is already carrying the token.

Index

• func IsLoopbackHost(host string) bool
• func Origin(raw string) (string, error)
• func SameOrigin(origin, raw string) bool

Functions

func IsLoopbackHost

func IsLoopbackHost(host string) bool

IsLoopbackHost reports whether host is the local machine — 127.0.0.0/8, ::1, or the "localhost" name. Nothing is resolved: a DNS lookup here would let an attacker-controlled name masquerade as loopback for exactly as long as the lookup said so, and the point of this check is that it cannot be talked out of its answer.

func Origin

func Origin(raw string) (string, error)

Origin returns the normalized scheme://host of raw if it is a place a bearer token may be sent, and an error naming the reason if it is not.

The floor is TLS: `https` anywhere, or `http` only to loopback — where there is no network to eavesdrop on, and where a plane under local development lives. Anything else would put an account-scoped credential on the wire in cleartext.

func SameOrigin

func SameOrigin(origin, raw string) bool

SameOrigin reports whether raw is on origin, which must already have come from Origin. A raw that is not a credential-safe URL is never the same origin as anything — the comparison fails closed rather than treating two unusable values as equal.