Harden CORS proxy and add deployment config - #75
Open
patrickunterwegs wants to merge 1 commit into
Open
Conversation
The Web (WASM) build routes CalDAV/WebDAV traffic through the Ktor proxy in server/ to work around browser CORS. This makes the proxy safe to host publicly and adds the artifacts to deploy it. Proxy hardening (server/Application.kt): - SSRF/open-relay guard: validate the caller-supplied target — scheme check, optional host allow-list, https-only, and block loopback/link-local/private/ unique-local addresses (e.g. 169.254.169.254). - Configurable via env: PORT, PROXY_ALLOWED_ORIGINS, PROXY_ALLOWED_TARGET_HOSTS, PROXY_REQUIRE_HTTPS_TARGET, PROXY_ALLOW_PRIVATE_TARGETS. - CORS restricted to configured origins (was anyHost + credentials). - Forward the request body whenever one is present, fixing WebDAV LOCK. - Don't forward Origin/Referer/Cookie; drop upstream Access-Control-* on the response; use slf4j logging instead of println. - Add the package declaration so the configured mainClass resolves. Wire up the in-app proxy setting (shared): - HttpClientFactory now resolves the proxy URL per request via a provider, so the "Proxy server" setting takes effect (previously the preference was never passed to the client). Modules.kt injects UserAppPreferencesStore. - Fix the settings preset/help text (localhost, not 0.0.0.0). Tests: rewrite ApplicationTest to compile against the real module() and cover the health endpoint, rejected targets (allow-list, https, private SSRF guard), CORS preflight, and a full proxied round-trip (7 tests). Deploy: server/Dockerfile (fat JAR), .dockerignore, fly.toml (Fly.io template), a GHCR image-publish workflow, and server/README.md documenting self-hosting and the credential-in-transit trust caveat. Update the main README accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VSN8H3sD3ZFXMbGb36Ls8q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Web (WASM) build routes CalDAV/WebDAV traffic through the Ktor proxy in server/ to work around browser CORS. This makes the proxy safe to host publicly and adds the artifacts to deploy it.
Proxy hardening (server/Application.kt):
Wire up the in-app proxy setting (shared):
Tests: rewrite ApplicationTest to compile against the real module() and cover the health endpoint, rejected targets (allow-list, https, private SSRF guard), CORS preflight, and a full proxied round-trip (7 tests).
Deploy: server/Dockerfile (fat JAR), .dockerignore, fly.toml (Fly.io template), a GHCR image-publish workflow, and server/README.md documenting self-hosting and the credential-in-transit trust caveat. Update the main README accordingly.
Claude-Session: https://claude.ai/code/session_01VSN8H3sD3ZFXMbGb36Ls8q