hypercorn: Missing proxy-headers option like one in gunicorn

Currently, it’s impossible to get a properly working service behind a proxy as headers like x-forwarded-for, x-forwarded-proto, x-forwarded-host, x-forwarded-port and x-forwarded-prefix isn’t checked. for and proto most critically needed, as they used in logging, application behaviors (including critical one, f.e.: return metrics if trusted_ips(client)) and URL generation (f.e.: url_for).

Can this be checked, please?

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Comments: 16 (1 by maintainers)

Most upvoted comments

See the ProxyFixMiddleware added in 4fc0372483210257d28d9e0b5f7746df145449c6

@pgjones Would you like me to work on this? I’m actually improving the ProxyHeadersMiddleware on Uvicorn right now.

I guess the idea here would be to populate the scope["client"], scope["host"] and scope["scheme"].

@pgjones in my setup it results in 500 and throws error in logs like:

It due to https://github.com/pgjones/hypercorn/issues/179 As a workaround, add it like described here: https://github.com/pgjones/hypercorn/commit/4fc0372483210257d28d9e0b5f7746df145449c6

You don’t need to switch back. You can use the ProxyHeadersMiddleware from uvicorn, and continue to use use hypercorn.

How can it be achieved when used as hypercorn+starlette only?

It truly works as:

...
from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
...
proxy_hosts = os.getenv('PROXY_HOSTS', '127.0.0.1').split(",")
app = Starlette()
app.add_middleware(ProxyHeadersMiddleware, trusted_hosts=proxy_hosts)
...

But I think importing another package is really bad just to get one basic middleware from it, right? Proxy thing is common and should be part of hypercorn - this is my point.

You don’t need to switch back. You can use the ProxyHeadersMiddleware from uvicorn, and continue to use use hypercorn.

@dragoangel Does it mean that you cannot access Proxy headers on your Starlette application?

It’s mean I not have options to get proper client ip, scheme, host on default variables while behind proxy and I don’t have a way to set trusted proxy. Using proxy should be transparent for code when used with proxy milter, e.g.:

  • no proxy, no milter, same code if (client)…
  • behind proxy, configured milter, same code if (client)…