kevin
38cd09f723
P0（高危）: - 新增全局 CSRF 中间件（同步器令牌），覆盖全部 30 个表单与 AJAX 请求 - 修复附件上传/列表/删除越权（IDOR），增加 admin/上传者/文章作者所有权校验 - 登录/注册成功后会话轮换，修复会话固定 - 会话密钥改用 crypto/rand 生成，配置缺失 secret 时拒绝启动 P1（中危）: - session 与 comment_uid cookie 增加 Secure/SameSite 标志 - 新增安全响应头：CSP、X-Content-Type-Options、X-Frame-Options、HSTS 等 - 新增 web.trusted_proxies 配置，修复 X-Forwarded-For 伪造 - 修复浏览量记录 goroutine 访问已回收 gin.Context 的数据竞争 补充 17 个安全回归测试（middleware/handlers），go test -race 全绿
24 lines
670 B
Go
24 lines
670 B
Go
package middleware
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// IsHTTPSRequest reports whether the client reached us over TLS. Behind a
|
|
// reverse proxy (Caddy/nginx) the app itself usually terminates plain
|
|
// connections, so X-Forwarded-Proto is consulted as well. The header is only
|
|
// honored when a trusted proxy forwarded the request - untrusted clients
|
|
// spoofing it can at worst break their own session (the cookie turns Secure
|
|
// and is refused over plain HTTP).
|
|
func IsHTTPSRequest(c *gin.Context) bool {
|
|
if c.Request.TLS != nil {
|
|
return true
|
|
}
|
|
if strings.EqualFold(c.GetHeader("X-Forwarded-Proto"), "https") {
|
|
return true
|
|
}
|
|
return false
|
|
}
|