1219 Commits

Author	SHA1	Message	Date
WeidiDeng	47f3e8f8dc	use math/rand/v2 instead of math/rand (#7413)	2026-02-11 09:15:51 -07:00
XYenon	03e6e439dd	reverseproxy: fix X-Forwarded-* headers for Unix socket requests (#7463) ... When a request arrives via a Unix domain socket (RemoteAddr == "@"), net.SplitHostPort fails, causing addForwardedHeaders to strip all X-Forwarded-* headers even when the connection is trusted via trusted_proxies_unix. Handle Unix socket connections before parsing RemoteAddr: if untrusted, strip headers for security; if trusted, let clientIP remain empty (no peer IP for a Unix socket hop) and fall through to the shared header logic, preserving the existing XFF chain without appending a spurious entry. Amp-Thread-ID: https://ampcode.com/threads/T-019c4225-a0ad-7283-ac56-e2c01eae1103 Co-authored-by: Amp <amp@ampcode.com>	2026-02-10 13:00:20 -07:00
Kévin Dunglas	7c28c0c07a	Merge commit from fork ... * fix: FastCGI split SCRIPT_NAME/PATH_INFO confusion * fix comment	2026-02-10 11:52:36 -07:00
Matthew Holt	1f43e8566b	caddyhttp: Use case-insensitive comparison for large Host lists	2026-02-09 14:18:55 -07:00
Matthew Holt	bd374ca9d7	caddyhttp: Lowercase comparison when matching with escape sequence	2026-02-09 13:12:00 -07:00
Francis Lavoie	2ae0f7af69	reverseproxy: Set Host to {upstream_hostport} automatically if TLS (#7454)	2026-02-09 13:06:19 -07:00
Matthew Holt	3bb22672f9	reverseproxy: Customizable dial network for SRV upstreams ... By request of a sponsor	2026-02-02 11:25:51 -07:00
Matthew Holt	7d24124430	caddyhttp: Reject invalid Host header (fix #7449)	2026-01-30 12:24:16 -07:00
Paulo Henrique	565c1c3054	autohttps: deterministic logic and strict bind checking on Linux (#7435) ... * http: fix non-deterministic auto-https and improve Linux bind matching * docs: restore historical context about Linux bind behavior	2026-01-16 08:51:23 -07:00
Mohammed Al Sahaf	e40bd019ff	caddyfile: add observe_catchall_hosts option (#7434) ... * caddyfile: add `observe_catchall_hosts` option Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * correct JSON field name and doc comment Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-01-14 00:06:16 +00:00
Paulo Henrique	62134d65af	reverseproxy: fix error when remote address is not an IP (#7429)	2026-01-13 19:52:56 +00:00
Francis Lavoie	90972fbebc	chore: Dumb prealloc lint fix (#7430)	2026-01-13 14:13:43 -05:00
Tom Paulus	6a57142896	headers: Make ApplyTo nil-safe (#7426)	2026-01-06 17:39:58 -05:00
WeidiDeng	80f2ae92cd	reverseproxy: make error chan bigger when reverse proxying websocket (#7419)	2026-01-06 04:55:47 -05:00
Felix Hildén	1f1be3f4fe	tracing: Add span attributes to tracing module (#7269) ... * WIP tracing span attributes * better test * only write attributes after other middleware (and request) * Fix test to use header response placeholders	2025-12-31 11:33:18 -07:00
Francis Lavoie	decc8a4d6f	logging: log_append Early option, Supports {http.response.body} (#7368) ... * logging: `log_append` early option * logging: `log_append` supports `{http.response.body}` * Convenience auto-early for request body	2025-12-16 23:42:42 -05:00
Francis Lavoie	4037d05760	caddyhttp: {http.request.body_base64} placeholder (#7367)	2025-12-13 21:01:12 -07:00
WeidiDeng	6e0cbd0fa0	caddyhttp: create a placeholder for and log ech status (#7328) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2025-12-07 16:01:58 +00:00
Steffen Busch	bfdb04912d	docs: add maybe template function documentation (#7388)	2025-12-06 06:51:28 -05:00
vnxme	31960dc998	Introduce packet conn wrappers (#7180) ... * packet_conn_wrappers: Initial changes * packet_conn_wrappers: Unwrap a packet conn only if there are no wrappers --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-12-04 14:15:56 -07:00
Francis Lavoie	be5f49fbeb	caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)	2025-12-03 18:46:11 +00:00
Petr	67a9e0657e	reverseproxy: Fix retries for requests with bodies (#7360) ... * capture the buffered body once, then reset clonedReq.Body before each retry * no copy * keep receiver name * set the buf to nil after extraction and only return it to pool if not nil --------- Co-authored-by: WeidiDeng <weidi_deng@icloud.com>	2025-11-24 12:03:18 -07:00
ledigang	2cb426776c	encode: modernize, replace HasSuffix+TrimSuffix with CutSuffix (#7357) ... Signed-off-by: ledigang <shuangcui@msn.com>	2025-11-21 15:30:26 -07:00
WeidiDeng	a6da1acdc8	reverse_proxy: use interfaces to modify the behaviors of the transports (#7353)	2025-11-17 09:51:37 -07:00
Kévin Dunglas	b3f2db233b	core: custom slog handlers for modules (log contextual data) (#7346)	2025-11-12 13:29:47 -07:00
Marten Seemann	f2199d48b2	chore: update quic-go to v0.56.0, enable qlog for HTTP/3 (#7345)	2025-11-08 00:41:15 -05:00
Kévin Dunglas	8285eba842	caddyhttp: allow customizing the Server header (#7338)	2025-11-03 21:00:27 -07:00
Cooper de Nicola	895b56063a	chore: fix golangci-lint error G602 in caddyhttp (#7334)	2025-11-03 03:04:55 +00:00
WeidiDeng	abe0acabb6	reverseproxy: set default values for keepalive if only some of them are set (#7318)	2025-10-25 05:15:55 -04:00
Philipp Keidel	b54e870b26	tracing: switch to autoexport for OpenTelemetry span exporter (#7317)	2025-10-23 17:54:50 -06:00
wyrapeseed	57587ed18e	refactor: use reflect.TypeFor (#7313) ... Signed-off-by: wyrapeseed <wyrapeseed@outlook.com>	2025-10-21 13:26:30 -06:00
WeidiDeng	1e21b660c4	reverseproxy: use http.Protocols to handle h2c requests (#6990)	2025-10-21 16:05:43 +00:00
Mohammed Al Sahaf	595aab8bc0	metrics: resolve per-host inifinite cardinality (#7306)	2025-10-21 06:06:56 +00:00
WeidiDeng	8aca108d2c	reverseproxy: do not disable keepalive if proxy protocol is used (#7300)	2025-10-21 05:09:37 +00:00
WeidiDeng	a7885aabec	intercept: use already buffered response if possible when intercepting (#7028)	2025-10-21 04:48:07 +00:00
WeidiDeng	1ce2a13ad1	caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)	2025-10-16 03:13:40 +00:00
Chris Seufert	d7185fd002	caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)	2025-10-16 02:47:32 +00:00
Anthony Biondo	7fb39ec1e5	reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3 (#7305) ... Co-authored-by: WeidiDeng <weidi_deng@icloud.com>	2025-10-16 02:20:20 +00:00
wyrapeseed	d115cd1042	chore: fix some comments (#7303)	2025-10-15 03:58:53 +00:00
joshuamcbeth	de6b78009b	caddyhttp: Add server options keepalive_idle and keepalive_count (#7298) ... * Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add Server option KeepAliveDisable (keepalive_disable) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add keepalive parameters to caddyfiletest Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> --------- Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>	2025-10-14 12:03:23 -06:00
WeidiDeng	2ec28bca43	reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)	2025-10-09 10:36:49 -06:00
GreyXor	13a4ec7597	basicauth: Implement argon2id (#7186) ... * feat: add argon2id hash-password command * feat: ardon2id owasp safe value * feat: add argon2id compare method * chore: fmt argon2id * docs: more argon2id docs * chore: upgrade x/crypto dep * revert: remove golangci * refactor: argon2id decode * chore: update deps * refactor: simplify argon2id compare return * chore: upgrade dependencies * chore: upgrade dependencies	2025-10-06 17:27:06 -06:00
asttool	bc0e184130	caddyhttp: omit unnecessary reassignment (#7276) ... Signed-off-by: asttool <asttool@outlook.com>	2025-09-26 10:44:58 -06:00
Mohammed Al Sahaf	25be2f26fc	chore: ugh, lint fix... (#7275) ... * chore: ugh, lint fix... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-09-26 03:14:48 -04:00
Gilbert Gilb's	f5c3094050	cmd: prevent commas in header values from being split (#7268) ... `pflag.GetStringSlice` treats commas as delimiters, which causes issues when passing headers whose values contain commas (`X-Robots-Tag: noindex, nofollow`). These are incorrectly split into multiple headers and errors out: - `X-Robots-Tag: noindex` - ` nofollow` Switch to `pflag.GetStringArray`, which does not split on commas[1]. Note that this changes behavior for cases where multiple headers were provided in a single argument with commas (`--header-down "X-Foo: Bar,X-Bar: Foo"`). Such cases will now be treated as a single header value. If this breaking change is unacceptable, we will need a smarter fallback mechanism. [1] https://github.com/spf13/pflag/pull/90	2025-09-22 21:12:06 -06:00
WeidiDeng	b462615439	fileserver: set Content-Length for precompressed files (#7251) ... * set Content-Length for precompressed files * Update modules/caddyhttp/fileserver/staticfiles.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com> --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-09-10 22:48:03 -06:00
Pavel	d9cc24f3df	caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238) ... Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-09-05 09:41:06 -06:00
Siomachkin	5473eb95d8	encode: fix response corruption when handle_errors is used (#7235) ... * encode: fix response corruption when handle_errors is used * Move disabled check before hdr assignment	2025-09-02 15:34:56 -06:00
Max Celant	3553cfb6ad	caddyhttp: remove redundant middleware next copy (#7217)	2025-09-01 09:30:34 -06:00
aro-lew	806fef85be	encode: add graphql-response header to list (#7214)	2025-08-27 14:58:14 -06:00