@chidchanun/bcp 0.1.26 → 0.1.28

package/packages/server/src/hardening-proxy.ts

@@ -0,0 +1,393 @@
+import * as http from "node:http";
+
+import {
+    applyProductionHttpServerHardening,
+    closeHttpServerGracefully,
+    getProductionHardeningConfig,
+    type ProductionHardeningConfig,
+} from "./production-hardening.js";
+
+export interface HardeningProxyOptions {
+    port: number;
+    hostname: string;
+    upstreamPort: number;
+    upstreamHostname?: string;
+}
+
+export function createHardeningProxy(
+    options: HardeningProxyOptions
+) {
+    const upstreamHostname =
+        options.upstreamHostname ??
+        "127.0.0.1";
+    const config =
+        getProductionHardeningConfig();
+    let server:
+        http.Server | null =
+        null;
+
+    async function start(): Promise<void> {
+        if (server) {
+            return;
+        }
+
+        server =
+            http.createServer(
+                (
+                    req,
+                    res
+                ) => {
+                    proxyRequest(
+                        req,
+                        res,
+                        upstreamHostname,
+                        options.upstreamPort,
+                        config
+                    );
+                }
+            );
+
+        applyProductionHttpServerHardening(
+            server,
+            config
+        );
+
+        await listen(
+            server,
+            options.port,
+            options.hostname
+        );
+    }
+
+    async function stop(): Promise<void> {
+        if (!server) {
+            return;
+        }
+
+        const current =
+            server;
+        server =
+            null;
+
+        await closeHttpServerGracefully(
+            current,
+            {
+                timeoutMs:
+                    config.shutdownTimeoutMs,
+            }
+        );
+    }
+
+    return {
+        start,
+        stop,
+        config,
+    };
+}
+
+function proxyRequest(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    upstreamHostname: string,
+    upstreamPort: number,
+    config: ProductionHardeningConfig
+): void {
+    const headers =
+        createForwardedHeaders(
+            req,
+            config.trustProxy
+        );
+    const upstream =
+        http.request({
+            hostname:
+                upstreamHostname,
+            port:
+                upstreamPort,
+            method:
+                req.method ??
+                "GET",
+            path:
+                req.url ??
+                "/",
+            headers,
+            timeout:
+                config.requestTimeoutMs,
+        });
+
+    upstream.on(
+        "timeout",
+        () => {
+            upstream.destroy(
+                new Error(
+                    "BCP Framework: upstream request timed out."
+                )
+            );
+        }
+    );
+
+    upstream.on(
+        "response",
+        (upstreamResponse) => {
+            for (
+                const [
+                    name,
+                    value,
+                ]
+                of Object.entries(
+                    upstreamResponse.headers
+                )
+            ) {
+                if (
+                    value !== undefined
+                ) {
+                    res.setHeader(
+                        name,
+                        value
+                    );
+                }
+            }
+
+            res.statusCode =
+                upstreamResponse.statusCode ??
+                502;
+
+            if (
+                upstreamResponse.statusMessage
+            ) {
+                res.statusMessage =
+                    upstreamResponse.statusMessage;
+            }
+
+            upstreamResponse.pipe(
+                res
+            );
+        }
+    );
+
+    upstream.on(
+        "error",
+        (error) => {
+            if (
+                res.headersSent
+            ) {
+                res.destroy(
+                    error
+                );
+                return;
+            }
+
+            res.writeHead(
+                502,
+                {
+                    "Content-Type":
+                        "text/plain; charset=utf-8",
+                    "Cache-Control":
+                        "no-store",
+                }
+            );
+            res.end(
+                "Bad Gateway"
+            );
+        }
+    );
+
+    req.on(
+        "aborted",
+        () => {
+            upstream.destroy();
+        }
+    );
+    req.on(
+        "error",
+        (error) => {
+            upstream.destroy(
+                error
+            );
+        }
+    );
+
+    req.pipe(
+        upstream
+    );
+}
+
+function createForwardedHeaders(
+    req: http.IncomingMessage,
+    trustProxy: boolean
+): http.OutgoingHttpHeaders {
+    const headers:
+        http.OutgoingHttpHeaders = {
+        ...req.headers,
+    };
+    const remoteAddress =
+        normalizeRemoteAddress(
+            req.socket.remoteAddress
+        );
+    const host =
+        firstHeader(
+            req.headers.host
+        );
+
+    if (!trustProxy) {
+        delete headers.forwarded;
+        delete headers[
+            "x-forwarded-for"
+        ];
+        delete headers[
+            "x-forwarded-host"
+        ];
+        delete headers[
+            "x-forwarded-proto"
+        ];
+        delete headers[
+            "x-real-ip"
+        ];
+    }
+
+    if (remoteAddress) {
+        const existingForwardedFor =
+            trustProxy
+                ? firstHeader(
+                    req.headers[
+                        "x-forwarded-for"
+                    ]
+                )
+                : undefined;
+
+        headers[
+            "x-forwarded-for"
+        ] =
+            existingForwardedFor
+                ? `${existingForwardedFor}, ${remoteAddress}`
+                : remoteAddress;
+        headers[
+            "x-real-ip"
+        ] =
+            trustProxy &&
+            firstHeader(
+                req.headers[
+                    "x-real-ip"
+                ]
+            )
+                ? firstHeader(
+                    req.headers[
+                        "x-real-ip"
+                    ]
+                )
+                : remoteAddress;
+    }
+
+    if (host) {
+        headers[
+            "x-forwarded-host"
+        ] =
+            trustProxy &&
+            firstHeader(
+                req.headers[
+                    "x-forwarded-host"
+                ]
+            )
+                ? firstHeader(
+                    req.headers[
+                        "x-forwarded-host"
+                    ]
+                )
+                : host;
+    }
+
+    headers[
+        "x-forwarded-proto"
+    ] =
+        trustProxy &&
+        firstHeader(
+            req.headers[
+                "x-forwarded-proto"
+            ]
+        )
+            ? firstHeader(
+                req.headers[
+                    "x-forwarded-proto"
+                ]
+            )
+            : "http";
+
+    return headers;
+}
+
+function normalizeRemoteAddress(
+    value: string | undefined
+): string | undefined {
+    if (!value) {
+        return undefined;
+    }
+
+    return value.startsWith(
+        "::ffff:"
+    )
+        ? value.slice(
+            "::ffff:".length
+        )
+        : value;
+}
+
+function firstHeader(
+    value:
+        string |
+        string[] |
+        undefined
+): string | undefined {
+    if (
+        Array.isArray(
+            value
+        )
+    ) {
+        return value[0];
+    }
+
+    return value;
+}
+
+function listen(
+    server: http.Server,
+    port: number,
+    hostname: string
+): Promise<void> {
+    return new Promise(
+        (
+            resolve,
+            reject
+        ) => {
+            const onError =
+                (error: Error) => {
+                    server.off(
+                        "listening",
+                        onListening
+                    );
+                    reject(
+                        error
+                    );
+                };
+            const onListening =
+                () => {
+                    server.off(
+                        "error",
+                        onError
+                    );
+                    resolve();
+                };
+
+            server.once(
+                "error",
+                onError
+            );
+            server.once(
+                "listening",
+                onListening
+            );
+            server.listen(
+                port,
+                hostname
+            );
+        }
+    );
+}