Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/requests/util/util.go

@@ -15,30 +15,30 @@ const (
 )
 
 // GetRequestProto returns the request scheme or X-Forwarded-Proto if present
-// and the request is proxied.
+// and the request came from a trusted reverse proxy.
 func GetRequestProto(req *http.Request) string {
 	proto := req.Header.Get(XForwardedProto)
-	if !IsProxied(req) || proto == "" {
+	if !CanTrustForwardedHeaders(req) || proto == "" {
 		proto = req.URL.Scheme
 	}
 	return proto
 }
 
 // GetRequestHost returns the request host header or X-Forwarded-Host if
-// present and the request is proxied.
+// present and the request came from a trusted reverse proxy.
 func GetRequestHost(req *http.Request) string {
 	host := req.Header.Get(XForwardedHost)
-	if !IsProxied(req) || host == "" {
+	if !CanTrustForwardedHeaders(req) || host == "" {
 		host = req.Host
 	}
 	return host
 }
 
 // GetRequestURI return the request URI or X-Forwarded-Uri if present and the
-// request is proxied.
+// request came from a trusted reverse proxy.
 func GetRequestURI(req *http.Request) string {
 	uri := req.Header.Get(XForwardedURI)
-	if !IsProxied(req) || uri == "" {
+	if !CanTrustForwardedHeaders(req) || uri == "" {
 		// Use RequestURI to preserve ?query
 		uri = req.URL.RequestURI()
 	}
@@ -46,8 +46,8 @@ func GetRequestURI(req *http.Request) string {
 }
 
 // GetRequestPath returns the request URI or X-Forwarded-Uri if present and the
-// request is proxied but always strips the query parameters and only returns
-// the pure path
+// request came from a trusted reverse proxy but always strips the query
+// parameters and only returns the pure path.
 func GetRequestPath(req *http.Request) string {
 	uri := GetRequestURI(req)
 
@@ -64,17 +64,18 @@ func GetRequestPath(req *http.Request) string {
 	return uri
 }
 
-// IsProxied determines if a request was from a proxy based on the RequestScope
-// ReverseProxy tracker.
-func IsProxied(req *http.Request) bool {
+// CanTrustForwardedHeaders determines if forwarded headers should be processed
+// based on the RequestScope and the direct caller's address.
+func CanTrustForwardedHeaders(req *http.Request) bool {
 	scope := middlewareapi.GetRequestScope(req)
 	if scope == nil {
 		return false
 	}
-	return scope.ReverseProxy
+
+	return scope.CanTrustForwardedHeaders(req)
 }
 
 func IsForwardedRequest(req *http.Request) bool {
-	return IsProxied(req) &&
+	return CanTrustForwardedHeaders(req) &&
 		req.Host != GetRequestHost(req)
 }