adding in some proxyification adjustments

underpants.go

@@ -98,6 +98,10 @@ type conf struct {
 		// A special group, `*`, may be specified which allows any authenticated
 		// user.
 		AllowedGroups []string `json:"allowed-groups"`
+
+		// Fix the host header on the requst to the backend proxied service to match
+		// what came in through the front door.
+		FixHost bool
 	}
 }
 
@@ -219,6 +223,9 @@ type disp struct {
 
 	// The groups which may access this backend.
 	groups []string
+
+	// if the host header is to be fixed for this dispatcher or not
+	fixhost bool
 }
 
 // Construct a URL to the oauth provider that with carry the provided URL as state
@@ -319,6 +326,10 @@ func serveHttpProxy(d *disp, w http.ResponseWriter, r *http.Request) {
 	br.Header.Add("Underpants-Email", url.QueryEscape(u.Email))
 	br.Header.Add("Underpants-Name", url.QueryEscape(u.Name))
 
+	if d.fixhost {
+		br.Host = d.host
+	}
+
 	bp, err := http.DefaultTransport.RoundTrip(br)
 	if err != nil {
 		panic(err)
@@ -432,8 +443,14 @@ func hostOf(name string, port int) string {
 func addSecurityHeaders(c *conf, next http.Handler) http.Handler {
 	if c.AddSecurityHeaders {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			var proto = "http"
 			if c.HasCerts() {
 				w.Header().Add("Strict-Transport-Security", "max-age=16070400; includeSubDomains")
+				proto = "https"
+			}
+
+			if r.Header.Get("X-Forwarded-Proto") != "" {
+				r.Header.Add("X-Forwarded-Proto", proto)
 			}
 
 			w.Header().Add("X-Frame-Options", "SAMEORIGIN")
@@ -470,12 +487,13 @@ func setup(c *conf, port int) (*http.ServeMux, error) {
 		}
 
 		m.Handle(fmt.Sprintf("%s/", host), addSecurityHeaders(c, &disp{
-			config: c,
-			route:  &route{host: uri.Host, scheme: uri.Scheme},
-			host:   host,
-			key:    key,
-			oauth:  oc,
-			groups: r.AllowedGroups,
+			config:  c,
+			route:   &route{host: uri.Host, scheme: uri.Scheme},
+			host:    host,
+			key:     key,
+			oauth:   oc,
+			groups:  r.AllowedGroups,
+			fixhost: r.FixHost,
 		}))
 	}