Class FrontEndProxyCheck

java.lang.Object
com.iizix.server.geo.ip2location.FrontEndProxyCheck
public final class FrontEndProxyCheck extends Object
Checks at server start that a server behind a front end knows its front end (CC-FIX-SIGNIN-THROTTLE-SOURCE, D-8).

A port that is front-end secured (PortConfig.isFrontEndSecured) is reached through a reverse proxy, so that every connection on it has the proxy's address. The address of the client is the one the proxy forwards, and it is believed only from a proxy the server setting ServerSettings.GEO_TRUSTED_PROXIES names (ClientAddressResolver). The setting is empty by default. While it is, every client of such a port is one and the same address to the server: the sign-in throttle counts all of them as one source, so that the failed sign-ins of anybody hold everybody back, and the session geolocation locates the proxy.

Nothing is changed or refused here: the operator is told, once, at start. The port flag is not taken as trust by itself, because it does not say who the front end is.

Author:
Christopher Mindus

  • Method Details

    • describe

      public static String describe(PortConfig[] portConfigs, String trustedProxies)
      Describes what is wrong with the trusted proxies of a server with these ports.
      Parameters:
      portConfigs - The ports of the web server, null for none.
      trustedProxies - The value of the server setting $geo.trustedProxies, null or blank for none.
      Returns:
      The warning, or null when there is nothing to warn of: no port is front-end secured, or at least one trusted proxy is named and every entry is an address.

    • warn

      public static boolean warn(PortConfig[] portConfigs, String trustedProxies)
      Logs the warning of describe(PortConfig[],String), when there is one.
      Parameters:
      portConfigs - The ports of the web server, null for none.
      trustedProxies - The value of the server setting $geo.trustedProxies.
      Returns:
      true when a warning was logged.

    • describeOpenBinding

      public static String describeOpenBinding(PortConfig[] portConfigs)
      Describes the front-end secured ports that are bound to every interface of the host (CC-FIX-RESET-LINK-BASE, proposal (b)). Such a port is reachable without the front-end proxy, from the LAN or from the Internet when the host is exposed: a connection that bypasses the proxy can forge the Host header the server reads the session's external base from (the base of the password reset link), and is believed secure (frontEndSecured) although it is plain HTTP.

      Nothing is changed or refused here: the operator is told, once, at start.

      Parameters:
      portConfigs - The ports of the web server, null for none.
      Returns:
      The warning, or null when no front-end secured port is without a bind address (or bound to the any-address 0.0.0.0 or ::).

    • warnOpenBinding

      public static boolean warnOpenBinding(PortConfig[] portConfigs)
      Logs the warning of describeOpenBinding(PortConfig[]), when there is one.
      Parameters:
      portConfigs - The ports of the web server, null for none.
      Returns:
      true when a warning was logged.