@cloud-cli/px 3.4.0 → 3.4.1

package/README.md

@@ -1,8 +1,8 @@
-## PX
+# PX
 
-Reverse proxy to map local services to http(s) subdomains
+Reverse proxy to map local services and external http(s) domains
 
-#### Usage
+## Usage
 
 Use it with [Cloudy](https://github.com/cloud-cli/cli)
 
@@ -14,11 +14,11 @@ import proxy from '@cloud-cli/px';
 export default { proxy };
 ```
 
-#### API
+## API
 
 **Add a proxy to a local service**
 
-```
+```bash
 cy proxy.add --domain "foo.example.com" --target "http://localhost:1234"
 ```
 
@@ -26,42 +26,43 @@ All available options:
 
 - `domain`: entrypoint for reverse proxy
 - `target`: any target for requests, can be local or remote
+- `cors`: handle CORS request on proxy level. See notes below!
 - `redirect`: if request comes as http, redirect to https
 - `redirectUrl`: if provided, issues a `Location` header and terminates with status 302 instead of proxying a request
 
 **Remove a proxy**
 
-```
+```bash
 cy proxy.remove --domain "foo.example.com"
 ```
 
 **Get details of a proxy**
 
-```
+```bash
 cy proxy.get --domain "foo.example.com"
 ```
 
 **List proxies**
 
-```
+```bash
 cy proxy.list
 ```
 
 **List registered domains**
 
-```
+```bash
 cy proxy.domains
 ```
 
 **Reload all configurations**
 
-```
+```bash
 cy proxy.reload
 ```
 
 ## Certificate file resolution
 
-```
+```bash
 certificatesFolder  = '/etc/letsencrypt/live' or process.env.PX_CERTS_FOLDER
 rootDomain          = 'example.com' in 'xyz.example.com'
 cert                = certificatesFolder + '/' + rootDomain + '/' + certificateFile
@@ -70,7 +71,20 @@ key                 = certificatesFolder + '/' + rootDomain + '/' + keyFile
 
 So xyz.example.com points to:
 
-```
+```bash
 /etc/letsencrypt/live/example.com/fullchain.pem   for certificate
 /etc/letsencrypt/live/example.com/privkey.pem     for private key
 ```
+
+## Notes
+
+CORS handling on proxy level is convenient, **but a security risk**. Beware:
+
+- All origins are allowed, all common methods and headers, and credentials are enabled.
+- In case of an `OPTIONS` request, if coming via CORS (a preflight), an empty response will be send and the request ends before calling the proxied target.
+
+Every request has 2 additional headers:
+
+- x-forwarded-for: the host of the original request.
+If a proxy is from 'https://foo.example.com' to 'http://localhost:1234', the header will be 'foo.example.com'
+- x-forwarded-proto: 'http:' or 'https:', depends on the original request

package/dist/proxy.js

@@ -68,7 +68,9 @@ export class ProxyServer {
             return status.isDirectory() ? dir : '';
         }));
         folders.filter(Boolean).forEach(async (rootDomain) => {
-            console.log(`Loading certificate for ${rootDomain}`);
+            if (process.env.DEBUG) {
+                console.log(`Loading certificate for ${rootDomain}`);
+            }
             certs[rootDomain] = createSecureContext({
                 cert: await readFile(join(certificatesFolder, rootDomain, certificateFile), 'utf8'),
                 key: await readFile(join(certificatesFolder, rootDomain, keyFile), 'utf8'),
@@ -114,6 +116,7 @@ export class ProxyServer {
         setHeaders(req, proxyRequest);
         proxyRequest.setHeader('host', getHost(target));
         proxyRequest.setHeader('x-forwarded-for', req.headers.host);
+        proxyRequest.setHeader('x-forwarded-proto', insecure ? 'http:' : 'https:');
         req.on('data', (chunk) => proxyRequest.write(chunk));
         req.on('end', () => proxyRequest.end());
         proxyRequest.on('error', (error) => handleError(error, res));
@@ -161,7 +164,7 @@ function setHeaders(from, to) {
     }
 }
 function handleError(error, res) {
-    console.log(error);
+    console.error(error);
     if (error.code === 'ECONNREFUSED') {
         res.writeHead(502);
         res.end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloud-cli/px",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Reverse Proxy",
   "main": "dist/index.js",
   "type": "module",