http://hg.omfa.de/prosody-hg/ en-us plugins/mod_http.lua revision history http://hg.omfa.de/prosody-hg/log/d08f18c35d27/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Fri, 20 Feb 2026 15:45:54 +0100 http://hg.omfa.de/prosody-hg/log/a4b58ea5bf7b/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Wed, 09 Apr 2025 18:11:57 +0200 http://hg.omfa.de/prosody-hg/log/61df1404dd7a/plugins/mod_http.lua
This fixes the problem that an un-bracketed IPv6 address will not match
the first pattern (since it matches brackets) and instead the first
decimal digits will match the pattern meant to strip port numbers from
IPv4 addresses, e.g. 2001:db8::1 --> 2000

This pattern instead matches enough of a regular IPv4 address to make an
IPv6 address fall back to the last case.]]> Kim Alvefur <zash@zash.se> Wed, 09 Apr 2025 15:54:54 +0200 http://hg.omfa.de/prosody-hg/log/5884d58707fa/plugins/mod_http.lua
This removes the need to configure e.g. http_external_url or similar
settings in order to get correct URLs out of prosodyctl, as the API
depends on portmanager to know the actual ports that are used.]]> Kim Alvefur <zash@zash.se> Wed, 26 Jul 2023 14:39:36 +0200 http://hg.omfa.de/prosody-hg/log/5022525364f6/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Mon, 17 Jul 2023 02:26:16 +0200 http://hg.omfa.de/prosody-hg/log/50324f66ca2a/plugins/mod_http.lua
Many of these fall into a few categories:
- util.cache size, must be >= 1
- byte or item counts that logically can't be negative
- port numbers that should be in 1..0xffff]]> Kim Alvefur <zash@zash.se> Mon, 17 Jul 2023 01:38:54 +0200 http://hg.omfa.de/prosody-hg/log/c8d949cf6b09/plugins/mod_http.lua
Improves readability ("1 day" vs 86400) and centralizes validation.]]> Kim Alvefur <zash@zash.se> Sun, 16 Jul 2023 20:49:33 +0200 http://hg.omfa.de/prosody-hg/log/9c13c11b199d/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sun, 18 Jun 2023 16:48:56 +0200 http://hg.omfa.de/prosody-hg/log/451cb119026e/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sat, 10 Jun 2023 13:06:05 +0200 http://hg.omfa.de/prosody-hg/log/5d5869f14c4d/plugins/mod_http.lua
Because it changes the type of the 'opt_origins' variable from util.set
to the internal _items table so next time an http app is added an error
"attempt to call a nil value (method 'empty')" is triggered. The value
is not used anywhere else.

Noticed when reviewing uses of the '_items' set property.

Not reported by any users, implying this setting is rarely used.]]> Kim Alvefur <zash@zash.se> Sat, 10 Jun 2023 12:33:58 +0200 http://hg.omfa.de/prosody-hg/log/7a6874f9fd40/plugins/mod_http.lua
Avoids the _items semi-private value, that is used everywhere for some
reason.]]> Kim Alvefur <zash@zash.se> Sat, 10 Jun 2023 12:18:09 +0200 http://hg.omfa.de/prosody-hg/log/f45a29b32f7a/plugins/mod_http.lua
Supporting both methods at the same time may open to spoofing attacks,
whereby a client sends a Forwarded header that is not stripped by a
reverse proxy, leading Prosody to use that instead of the X-Forwarded-*
headers actually sent by the proxy.

By only supporting one at a time, it can be configured to match what the
proxy uses.

Disabled by default since implementations are sparse and X-Forwarded-*
are everywhere.]]> Kim Alvefur <zash@zash.se> Sat, 03 Jun 2023 21:53:20 +0200 http://hg.omfa.de/prosody-hg/log/d043834f15d2/plugins/mod_http.lua
Prefer over X-Forwarded-* since it has an actual specification.

Main practical difference is that Forwarded may carry more properties
than only the IP address since it is a structured header.

Since we parse it into an array, it is easier to do the logical thing
and iterate backwards trough proxies until an untrusted one is
encountered. Compare the handling of X-Forwarded-For.

The 'secure' field now accounts for the full chain of proxies, which
must be secure all the way to be considered secure.]]> Kim Alvefur <zash@zash.se> Sat, 03 Jun 2023 17:10:04 +0200 http://hg.omfa.de/prosody-hg/log/90394be5e6a5/plugins/mod_http.lua
There are hints that this format might be used in X-Forwarded-For as
well, so best handle it everywhere. Strips both brackets and optional
port number.]]> Kim Alvefur <zash@zash.se> Sat, 03 Jun 2023 17:10:12 +0200 http://hg.omfa.de/prosody-hg/log/9c4dc1e6d2c9/plugins/mod_http.lua
This could be of help when configuring reverse proxies, as it is the
internal URL the proxy must point at.

Argument treated as an enum "internal" "external"(default) to allow for
future extensibility.]]> Kim Alvefur <zash@zash.se> Wed, 24 May 2023 14:43:45 +0200 http://hg.omfa.de/prosody-hg/log/45caa4e43775/plugins/mod_http.lua
a863e4237b91 unintentionally changed the format of HTTP CORS headers,
which were apparently relying on the output of tostring(), which it
shouldn't have.

Explicitly serializing it this time.]]> Kim Alvefur <zash@zash.se> Mon, 10 Apr 2023 11:50:27 +0200 http://hg.omfa.de/prosody-hg/log/74b9e05af71e/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Fri, 24 Mar 2023 13:15:28 +0100 http://hg.omfa.de/prosody-hg/log/419e55abd285/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sun, 05 Mar 2023 15:45:01 +0100 http://hg.omfa.de/prosody-hg/log/24b55f0e2db9/plugins/mod_http.lua
Fixes #1779.

Due to an oversight in the logic, if the user set 'enabled' to false in an
override, it would disable the item's requested CORS settings, but still apply
Prosody's default CORS policy.

This change ensures that 'enabled = false' will now disable CORS entirely for
the requested item.

Due to the new structure of the code, it was necessary to have a flag to say
whether CORS is to be applied at all. Rather than hard-coding 'true' here, I
chose to add a new option: 'http_default_cors_enabled'. This is a boolean that
allows the operator to disable Prosody's default CORS policy entirely (the one
that is used when a module or config does not override it). This makes it
easier to disable CORS and then selectively enable it only on services you
want it on.]]> Matthew Wild <mwild1@gmail.com> Mon, 31 Oct 2022 14:32:02 +0000 http://hg.omfa.de/prosody-hg/log/b33558969b3e/plugins/mod_http.lua
The same-origin policy enforced by browsers is a security measure that should
only be turned off when it is safe to do so. It is safe to do so in Prosody's
default modules, but people may load third-party modules that are unsafe.

Therefore we have flipped the default, so that modules must explicitly opt in
to having CORS headers added on their requests.]]> Matthew Wild <mwild1@gmail.com> Mon, 28 Mar 2022 14:53:24 +0100 http://hg.omfa.de/prosody-hg/log/17d87fb2312a/plugins/mod_http.lua
This is far better than pre-0.12, because we now have a universal way to
configure and enable/disable CORS on a per-module basis.]]> Matthew Wild <mwild1@gmail.com> Mon, 28 Mar 2022 14:40:21 +0100 http://hg.omfa.de/prosody-hg/log/a19d435dee90/plugins/mod_http.lua
http://[::]:5280/ is as sensible as http://*:5280/ so why not

This might be a bit weird when listening no multiple interfaces but not
sure we can really do anything sensible then anyway.]]> Kim Alvefur <zash@zash.se> Fri, 04 Feb 2022 20:11:18 +0100 http://hg.omfa.de/prosody-hg/log/d41e8c7890b0/plugins/mod_http.lua
This might make the global routes less confusing sometimes, or at least
valid URLs instead of http://*:5280/ which doesn't make much sense.]]> Kim Alvefur <zash@zash.se> Fri, 04 Feb 2022 19:58:43 +0100 http://hg.omfa.de/prosody-hg/log/6a772a0c0dfd/plugins/mod_http.lua
This is either caused by an earlier failure to bind http/s ports, in
which case that should be corrected, or explicitly disbling the http/s
ports, in which case ... why enable http modules?

Suggested by jonas’]]> Kim Alvefur <zash@zash.se> Sat, 15 Jan 2022 17:37:07 +0100 http://hg.omfa.de/prosody-hg/log/8b57362f1176/plugins/mod_http.lua
When http_external_url is set then the portmanager usage only really
serves as a check of whether any http service is enabled at all.

Should allow generating an URL from prosodyctl when http_external_url is
set.]]> Kim Alvefur <zash@zash.se> Sat, 27 Nov 2021 12:26:15 +0100 http://hg.omfa.de/prosody-hg/log/94253e02d47d/plugins/mod_http.lua
Since accessing this port directly over the wider Internet is unlikely
to intentional anymore. Most uses will likely be by reverse proxies, by
mistake or because of trouble configuring HTTPS.

Blocking mistaken uses is just a good thing, letting users send
potentially private things unencrypted tends to be Strongly Discouraged
these days.

Many reverse proxy setups operate over loopback, so listening there
instead of all interfaces is a net improvement.

Improved automatic certificate location and SNI support has mostly
eliminated the need for manual certificate configuration so HTTPS should
Just Work once certificates have been provided.

For local testing during development, connecting over loopback is likely
fine as well. When really needed, `http_interfaces` can still be set.

Suggested by Link Mauve]]> Kim Alvefur <zash@zash.se> Sat, 15 Jan 2022 15:13:41 +0100 http://hg.omfa.de/prosody-hg/log/86e6f0810956/plugins/mod_http.lua
These would previously be left behind. Probably mostly harmless except
for clogging up the `debug:events()` listing in the console.]]> Kim Alvefur <zash@zash.se> Wed, 22 Dec 2021 19:27:03 +0100 http://hg.omfa.de/prosody-hg/log/f3aee8a825cc/plugins/mod_http.lua
Also special thanks to timeless, for wordlessly reminding me to check
for typos.]]> Kim Alvefur <zash@zash.se> Tue, 27 Jul 2021 00:13:18 +0200 http://hg.omfa.de/prosody-hg/log/2ea70d291429/plugins/mod_http.lua
Trying to move everything relating to proxies and X-Forwarded-Foo into a
single place.]]> Kim Alvefur <zash@zash.se> Sat, 27 Feb 2021 21:37:56 +0100 http://hg.omfa.de/prosody-hg/log/d30c44a829c1/plugins/mod_http.lua
Because it already sets request.secure, which depends on the connection,
just like the IP, so it makes sense to do both in the same place.

Dealing with proxies can be left to mod_http for now, but maybe it could
move into some util some day?]]> Kim Alvefur <zash@zash.se> Sat, 27 Feb 2021 21:37:16 +0100 http://hg.omfa.de/prosody-hg/log/1b6298e7b550/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sat, 27 Feb 2021 21:07:36 +0100 http://hg.omfa.de/prosody-hg/log/8d6e013377fa/plugins/mod_http.lua
8603011e51fe optimized out more than just the loop, leaving the .ip
field blank when the request wasn't from a proxy.]]> Kim Alvefur <zash@zash.se> Sat, 27 Feb 2021 20:45:45 +0100 http://hg.omfa.de/prosody-hg/log/19a59cb7311e/plugins/mod_http.lua
This was the late night early draft text, thought I had amended this but
apparently I forgot.]]> Kim Alvefur <zash@zash.se> Tue, 23 Feb 2021 16:07:41 +0100 http://hg.omfa.de/prosody-hg/log/d5d895313be2/plugins/mod_http.lua
Makes no sense to have a http module with no handlers

Would have helped me when I accidentally

module:provides("http", {
GET = handler;
})]]> Kim Alvefur <zash@zash.se> Sun, 21 Feb 2021 01:00:00 +0100 http://hg.omfa.de/prosody-hg/log/27a22a1f141c/plugins/mod_http.lua
E.g.

module:provides("http", {
cors = {
headers = {
Accept = true;
Expect = false;
};
};
route = { ... };
});

Case might be weird.]]> Kim Alvefur <zash@zash.se> Mon, 30 Dec 2019 09:50:59 +0100 http://hg.omfa.de/prosody-hg/log/f6bb3b193277/plugins/mod_http.lua
E.g.

module:provides("http", {
cors = {
credentials = true;
};
route = { ... };
});]]> Kim Alvefur <zash@zash.se> Mon, 30 Dec 2019 09:49:28 +0100 http://hg.omfa.de/prosody-hg/log/4f97b33e2596/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 14:43:45 +0100 http://hg.omfa.de/prosody-hg/log/e40ba204c612/plugins/mod_http.lua
is_trusted_proxy() is only in trunk, I dun goofed when I rebased
8603011e51fe from trunk.]]> Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 14:34:38 +0100 http://hg.omfa.de/prosody-hg/log/c81b6b8c6b19/plugins/mod_http.lua
No need to do a subnet match comparison to see if two IP addresses match
exactly.]]> Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 10:41:04 +0100 http://hg.omfa.de/prosody-hg/log/98b7ae7064b2/plugins/mod_http.lua
Should be better than setting consider_{bosh,websocket}_secure as that
may end up causing actually insecure requests to be considered secure.

Doing it here, as with IP, should make this apply to all HTTP modules.]]> Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 10:00:56 +0100 http://hg.omfa.de/prosody-hg/log/a0477656258c/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 12:02:11 +0100 http://hg.omfa.de/prosody-hg/log/8603011e51fe/plugins/mod_http.lua
Skips doing the whole get_ip_from_request() dance if the request isn't
from a proxy at all, even if the client sent the header for some reason.]]> Kim Alvefur <zash@zash.se> Thu, 18 Feb 2021 12:00:00 +0100 http://hg.omfa.de/prosody-hg/log/dc41c8dfd2b1/plugins/mod_http.lua Matthew Wild <mwild1@gmail.com> Fri, 11 Sep 2020 12:37:07 +0100 http://hg.omfa.de/prosody-hg/log/3e5bc34be734/plugins/mod_http.lua
Fixes #726

API:

module:provides("http", {
streaming_uploads = true;
route = {
PUT = function (event)
event.request.body_sink = io.tmpfile();
return true;
end
}
})]]> Kim Alvefur <zash@zash.se> Sat, 01 Aug 2020 18:41:30 +0200 http://hg.omfa.de/prosody-hg/log/9673c95895fb/plugins/mod_http.lua
This enables uses such as saving uploaded files directly to a file on
disk or streaming parsing of payloads.

See #726]]> Kim Alvefur <zash@zash.se> Sat, 01 Aug 2020 18:41:23 +0200 http://hg.omfa.de/prosody-hg/log/dff1aebd0f2b/plugins/mod_http.lua Boris Grozev <boris@jitsi.org> Wed, 10 Jun 2020 13:15:57 -0500 http://hg.omfa.de/prosody-hg/log/22f783d80eec/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Thu, 14 May 2020 16:55:01 +0200 http://hg.omfa.de/prosody-hg/log/a83bfb266b15/plugins/mod_http.lua
Because docs are good.]]> Jonas Schäfer <jonas@wielicki.name> Thu, 14 May 2020 14:59:59 +0200 http://hg.omfa.de/prosody-hg/log/09697a673015/plugins/mod_http.lua
Potentially a bit more efficient since it can jump to the selected
protocol on connect instead of waiting for some data to look at.

Adds a 'protocol' field to net providers for this purpose.]]> Kim Alvefur <zash@zash.se> Fri, 29 Nov 2019 23:27:51 +0100 http://hg.omfa.de/prosody-hg/log/5ce6cbb5ce6a/plugins/mod_http.lua
These are similar to the "activated service" messages from portmanager
and similarily useful for the service admin to know even if they're not
debugging anything.]]> Kim Alvefur <zash@zash.se> Fri, 29 Nov 2019 21:30:08 +0100 http://hg.omfa.de/prosody-hg/log/abfc05495d8b/plugins/mod_http.lua
This allows disabling mod_http_errors by adding it to
moduless_disabled and ensures mod_http loads even if the error pages
aren't as pretty.]]> Kim Alvefur <zash@zash.se> Sat, 16 Nov 2019 16:39:45 +0100 http://hg.omfa.de/prosody-hg/log/d4c538a7d655/plugins/mod_http.lua
Prevents CORS related handlers from being left over on reload.

BC: `mod_http.apps[app_name][event_name]` is now a table instead of the
main handler function.]]> Kim Alvefur <zash@zash.se> Thu, 10 Oct 2019 20:46:27 +0200 http://hg.omfa.de/prosody-hg/log/4ff2f14f9ac7/plugins/mod_http.lua Matthew Wild <mwild1@gmail.com> Wed, 11 Sep 2019 15:10:31 +0100 http://hg.omfa.de/prosody-hg/log/6ea3cafb6ac3/plugins/mod_http.lua
Since it's mostly only mod_s2s that needs to request client
certificates it makes some sense to have mod_s2s ask for this, instead
of having eg mod_http ask to disable it.]]> Kim Alvefur <zash@zash.se> Sun, 10 Mar 2019 19:58:28 +0100 http://hg.omfa.de/prosody-hg/log/071538a567d5/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Thu, 17 Jan 2019 20:42:38 +0100 http://hg.omfa.de/prosody-hg/log/adfb29f44412/plugins/mod_http.lua
Lower priority to allow http modules to handle it themselves, should
they wish to]]> Kim Alvefur <zash@zash.se> Fri, 18 Jan 2019 02:03:40 +0100 http://hg.omfa.de/prosody-hg/log/9993fd021d19/plugins/mod_http.lua
This blindly allows any cross-site requests.

Future work should add an API to allow each HTTP app some influence over
this for each HTTP path]]> Kim Alvefur <zash@zash.se> Thu, 04 Oct 2018 12:22:12 +0200 http://hg.omfa.de/prosody-hg/log/cfbea3064aa9/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sun, 14 Oct 2018 14:31:59 +0200 http://hg.omfa.de/prosody-hg/log/3456496d5218/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sun, 14 Oct 2018 14:19:21 +0200 http://hg.omfa.de/prosody-hg/log/09e7b0048ebe/plugins/mod_http.lua Kim Alvefur <zash@zash.se> Sun, 14 Oct 2018 14:01:57 +0200