From 8c42b656874edad6d55c2c8c533feabb67233521 Mon Sep 17 00:00:00 2001 From: Dj Walker-Morgan Date: Tue, 8 Sep 2020 10:29:44 +0100 Subject: [PATCH 1/5] Merge github.com/PierreZ/goStatic/pull/34/ --- main.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/main.go b/main.go index 58d4da0..48c7f2c 100644 --- a/main.go +++ b/main.go @@ -28,6 +28,7 @@ var ( setBasicAuth = flag.String("set-basic-auth", "", "Define the basic auth. Form must be user:password") defaultUsernameBasicAuth = flag.String("default-user-basic-auth", "gopher", "Define the user") sizeRandom = flag.Int("password-length", 16, "Size of the randomized password") + logRequest = flag.Bool("enable-logging", false, "Enable log request") username string password string @@ -65,6 +66,15 @@ func (w *gzipResponseWriter) Write(b []byte) (int, error) { return w.Writer.Write(b) } +func handleReq(h http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if *logRequest { + log.Println(r.Method, r.URL.Path) + } + h.ServeHTTP(w, r) + }) +} + func main() { flag.Parse() @@ -85,7 +95,7 @@ func main() { } } - handler := http.FileServer(fileSystem) + handler := handleReq(http.FileServer(fileSystem)) pathPrefix := "/" if len(*context) > 0 { From 22acfdcc3c204312b6e4f3e7b95437c166b6c573 Mon Sep 17 00:00:00 2001 From: Dj Walker-Morgan Date: Tue, 8 Sep 2020 14:52:18 +0100 Subject: [PATCH 2/5] Added -https-promote switch --- Dockerfile | 4 ++-- README.md | 4 ++++ main.go | 8 ++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index c488369..59b0b1e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,5 +15,5 @@ FROM scratch WORKDIR / COPY --from=builder /go/src/github.com/PierreZ/goStatic/bin/ . USER appuser -ENTRYPOINT ["/goStatic"] - \ No newline at end of file +ENTRYPOINT ["/goStatic","-enable-logging","-https-promote"] + diff --git a/README.md b/README.md index 205c165..105b51f 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,10 @@ Usage of /goStatic: The listening port (default 8043) -set-basic-auth string Define the basic auth. Form must be user:password + -https-promote + Connections to http: are redirected to https: + -enable-logging + Writes a simple log entry for requests to the server ``` #### Fallback diff --git a/main.go b/main.go index 48c7f2c..c383c81 100644 --- a/main.go +++ b/main.go @@ -29,6 +29,7 @@ var ( defaultUsernameBasicAuth = flag.String("default-user-basic-auth", "gopher", "Define the user") sizeRandom = flag.Int("password-length", 16, "Size of the randomized password") logRequest = flag.Bool("enable-logging", false, "Enable log request") + httpsPromote = flag.Bool("https-promote", false, "All HTTP requests should be redirected to HTTPS") username string password string @@ -68,6 +69,13 @@ func (w *gzipResponseWriter) Write(b []byte) (int, error) { func handleReq(h http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.Header.Get("X-Forwarded-Proto") == "http" { + http.Redirect(w, r, "https://"+r.Host+r.RequestURI, http.StatusMovedPermanently) + if *logRequest { + log.Println(301, r.Method, r.URL.Path) + } + return + } if *logRequest { log.Println(r.Method, r.URL.Path) } From eb2c228c60e09f81e1322c3aad4a9e66700477e4 Mon Sep 17 00:00:00 2001 From: Dj Walker-Morgan Date: Thu, 10 Sep 2020 12:47:32 +0100 Subject: [PATCH 3/5] Updated Readme --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 105b51f..dcc83cc 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Yeah, decided to drop support of unsecured HTTPS. Two-years ago, when I started * A fully static web server in 6MB * No framework * Web server built for Docker - * Can generate certificate on its own + * Can generate the certificate on its own * Light container * More secure than official images (see below) * Log enabled @@ -23,7 +23,7 @@ Because the official Golang image is wayyyy too big (around 1/2Gb as you can see [![](https://badge.imagelayers.io/golang:latest.svg)](https://imagelayers.io/?images=golang:latest 'Get your own badge on imagelayers.io') For me, the whole point of containers is to have a light container... -Many links should provide you with additionnal info to see my point of view: +Many links should provide you with additional info to see my point of view: * [Over 30% of Official Images in Docker Hub Contain High Priority Security Vulnerabilities](http://www.banyanops.com/blog/analyzing-docker-hub/) * [Create The Smallest Possible Docker Container](http://blog.xebia.com/2014/07/04/create-the-smallest-possible-docker-container/) @@ -68,7 +68,7 @@ Usage of /goStatic: #### Fallback -The fallback option is principally useful for single page applications (SPAs) where the browser may request a file, but where part of the path is in fact an internal route in the application, not a file on disk. goStatic supports two possible usages of this option: +The fallback option is principally useful for single-page applications (SPAs) where the browser may request a file, but where part of the path is in fact an internal route in the application, not a file on disk. goStatic supports two possible usages of this option: 1. Using an absolute path so that all not found requests resolve to the same file 2. Using a relative file, which searches up the tree for the specified file From 6ca38384a8f6a58e569024dc50373b075d4e25b0 Mon Sep 17 00:00:00 2001 From: Dj Walker-Morgan Date: Thu, 10 Sep 2020 12:49:06 +0100 Subject: [PATCH 4/5] typo fixes --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index dcc83cc..0c36bfb 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ Yeah, decided to drop support of unsecured HTTPS. Two-years ago, when I started * Log enabled ### Why? -Because the official Golang image is wayyyy too big (around 1/2Gb as you can see below) and could be unsecure. +Because the official Golang image is wayyyy too big (around 1/2Gb as you can see below) and could be insecure. [![](https://badge.imagelayers.io/golang:latest.svg)](https://imagelayers.io/?images=golang:latest 'Get your own badge on imagelayers.io') From 75ec8df8c7b1f03eeb6ae51fb7aa1c97506159cf Mon Sep 17 00:00:00 2001 From: Dj Walker-Morgan Date: Thu, 10 Sep 2020 13:00:09 +0100 Subject: [PATCH 5/5] Add promote check (oops) --- main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.go b/main.go index c383c81..c05ab5a 100644 --- a/main.go +++ b/main.go @@ -69,7 +69,7 @@ func (w *gzipResponseWriter) Write(b []byte) (int, error) { func handleReq(h http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get("X-Forwarded-Proto") == "http" { + if *httpsPromote && r.Header.Get("X-Forwarded-Proto") == "http" { http.Redirect(w, r, "https://"+r.Host+r.RequestURI, http.StatusMovedPermanently) if *logRequest { log.Println(301, r.Method, r.URL.Path)