mirror of
https://github.com/docker/docker-agent.git
synced 2026-11-04 10:02:15 +00:00
David Gageot
ca4254f2d8
Require --auth-token on non-loopback listeners, enforce JSON content-type and origin checks on every method (not just mutations), and add --remote-auth-token so `run --remote` can talk to a token-protected listener. Assisted-By: docker-agent
36 lines
1.0 KiB
Go
36 lines
1.0 KiB
Go
package server
|
|
|
|
import (
|
|
"mime"
|
|
"net/http"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
func sameOrigin() echo.MiddlewareFunc {
|
|
var protection http.CrossOriginProtection
|
|
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c echo.Context) error {
|
|
// GET can initialize tool processes, so even safe methods need checking.
|
|
req := *c.Request()
|
|
req.Method = http.MethodPost
|
|
if err := protection.Check(&req); err != nil {
|
|
return echo.NewHTTPError(http.StatusForbidden, err.Error())
|
|
}
|
|
return next(c)
|
|
}
|
|
}
|
|
}
|
|
|
|
func requireJSON(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c echo.Context) error {
|
|
mediaType, params, err := mime.ParseMediaType(c.Request().Header.Get(echo.HeaderContentType))
|
|
if err != nil || mediaType != echo.MIMEApplicationJSON {
|
|
return echo.NewHTTPError(http.StatusUnsupportedMediaType, "Content-Type must be application/json")
|
|
}
|
|
// Echo's binder matches media types case-sensitively.
|
|
c.Request().Header.Set(echo.HeaderContentType, mime.FormatMediaType(mediaType, params))
|
|
return next(c)
|
|
}
|
|
}
|