core/go-proxy
8
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(api): enforce GET on monitoring routes

Browse source 
Co-Authored-By: Virgil <virgil@lethean.io>
This commit is contained in:
Virgil 2026-04-05 02:43:49 +00:00
parent b3fd1fef61
commit bc6113c80d
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
http_auth_test.go
View file

@ -57,7 +57,7 @@ func TestProxy_allowHTTP_Unrestricted_Good(t *testing.T) {
},
}
status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodPost})
status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodGet})
if !ok {
t.Fatalf("expected unrestricted request to pass, got status %d", status)
}
@ -66,6 +66,22 @@ func TestProxy_allowHTTP_Unrestricted_Good(t *testing.T) {
}
}
func TestProxy_allowHTTP_Unrestricted_Bad(t *testing.T) {
p := &Proxy{
config: &Config{
HTTP: HTTPConfig{},
},
}
status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodPost})
if ok {
t.Fatal("expected non-GET request to be rejected even when unrestricted")
}
if status != http.StatusMethodNotAllowed {
t.Fatalf("expected status %d, got %d", http.StatusMethodNotAllowed, status)
}
}
func TestProxy_allowHTTP_Ugly(t *testing.T) {
p := &Proxy{
config: &Config{

2
state_impl.go
View file

@ -675,7 +675,7 @@ func (p *Proxy) allowMonitoringRequest(r *http.Request) (int, bool) {
if p == nil || p.config == nil {
return http.StatusServiceUnavailable, false
}
if p.config.HTTP.Restricted && r.Method != http.MethodGet {
if r.Method != http.MethodGet {
return http.StatusMethodNotAllowed, false
}
if token := p.config.HTTP.AccessToken; token != "" {