Do not set 0.0.0.0 (for unparsable addresses) and a fake port about go-forwarded HOT 3 OPEN

Hi Jacques @0xjac!

Sorry, it took me a white to remember this library and reread the code.

I find your concerns perfectly valid and the PR is welcome.

It looks like that the library is used in at least one other project, so the "proper" change where the lines 119-126 are removed is going to break the contract. This would be a perfect case for a v2, but I honestly have to time to maintain the library.

The least intrusive fix would be to add a boolean (?) flag/property to the Wrapper struct and change behaviour based on it, not even changing the constructor signature.

from go-forwarded.

@stanvit thanks for your reply. I've been doing some more digging and I have noticed a few more things that are needed such as:

1. Switch to a go module
2. Pass obfuscated identifiers as allowed to set the header (instead of just IPs and CIDR).
3. Handle multiple values as list and repeated headers for Forwarded
4. Expose a HandlerFunc or something a bit more friendly to integrate with popular web frameworks which don't support http.Handler natively (like gin)

All in all, this is a bit more work than I initially anticipated. I don't want to take up too much of your time, especially if you don't have time to maintain a v2. Hence I am thinking of writing (and maintaining) a new library based/inspired by yours (properly credited of course).

That being said, if you still want a PR for the flag/property addressing the 0.0.0.0 address and fake port. I'll happily submit one as I initially offered!

from go-forwarded.

Thanks for understanding. I think starting a new project would be the best - with all five points you listed here. I'll happily place a link to your project in my README when it's ready if you like.

Please don't bother with the PR, I'll just redirect everyone interested in newer/better functionality to your project.

from go-forwarded.