From 246a31aacd7159acc009ff6d6497596a96533f73 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Fri, 17 Jul 2020 17:54:58 -0600 Subject: reverseproxy: Restore request's original host and header (fix #3509) We already restore them within the retry loop, but after successful proxy we didn't reset them, so as handlers bubble back up, they would see the values used for proxying. Thanks to @ziddey for identifying the cause. --- modules/caddyhttp/reverseproxy/reverseproxy.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'modules') diff --git a/modules/caddyhttp/reverseproxy/reverseproxy.go b/modules/caddyhttp/reverseproxy/reverseproxy.go index 7971348..bb1453a 100644 --- a/modules/caddyhttp/reverseproxy/reverseproxy.go +++ b/modules/caddyhttp/reverseproxy/reverseproxy.go @@ -329,10 +329,17 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht fmt.Errorf("preparing request for upstream round-trip: %v", err)) } - // we will need the original headers and Host - // value if header operations are configured - reqHeader := r.Header + // we will need the original headers and Host value if + // header operations are configured; and we should + // restore them after we're done if they are changed + // (for example, changing the outbound Host header + // should not permanently change r.Host; issue #3509) reqHost := r.Host + reqHeader := r.Header + defer func() { + r.Host = reqHost + r.Header = reqHeader + }() start := time.Now() -- cgit v1.2.3