Reverse Proxy و TLS: اللي واقف قدام الـ app

// proxy.js: reverse proxy حقيقي بـ node:http، والـ client IP الحقيقي ورا proxies، والـ headers اللي بتتشال وبتتضاف
import http from "node:http";
import net from "node:net";

export const normalizeIp = (ip) => String(ip ?? "").trim().replace(/^::ffff:(?=\d+\.\d+\.\d+\.\d+$)/, "");

const v4 = (ip) => ip.split(".").reduce((n, o) => n * 256 + Number(o), 0);

export function inCidr(ip, cidr) {
  ip = normalizeIp(ip);
  const [base, bits = net.isIPv4(base) ? "32" : "128"] = cidr.split("/");
  if (!net.isIPv4(ip) || !net.isIPv4(base)) return ip === normalizeIp(base); // IPv6: مقارنة مباشرة بس
  const b = Number(bits);
  const mask = b === 0 ? 0 : 2 ** 32 - 2 ** (32 - b);
  return (v4(ip) & mask) >>> 0 === (v4(base) & mask) >>> 0;
}

export function clientIp(xff, remote, trusted) {
  const chain = [...String(xff ?? "").split(",").map(normalizeIp).filter(Boolean), normalizeIp(remote)];
  if (typeof trusted === "number") return chain[Math.max(0, chain.length - 1 - trusted)];
  for (let i = chain.length - 1; i >= 0; i--) if (!trusted.some((c) => inCidr(chain[i], c))) return chain[i];
  return chain[0];
}

export const HOP_BY_HOP = ["connection", "keep-alive", "proxy-connection", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"];

export function stripHopByHop(headers) {
  const conn = Object.entries(headers).find(([k]) => k.toLowerCase() === "connection")?.[1];
  const named = String(conn ?? "").toLowerCase().split(",").map((s) => s.trim()).filter(Boolean);
  const out = {};
  for (const [k, v] of Object.entries(headers)) {
    const key = k.toLowerCase();
    if (!HOP_BY_HOP.includes(key) && !named.includes(key)) out[key] = v;
  }
  return out;
}

export function forwardHeaders(headers, { remote, proto = "http", edge = false }) {
  const h = stripHopByHop(headers);
  const ip = normalizeIp(remote);
  if (edge) { delete h["x-forwarded-for"]; delete h["x-forwarded-proto"]; delete h["x-forwarded-host"]; delete h["x-real-ip"]; delete h.forwarded; }
  h["x-forwarded-for"] = h["x-forwarded-for"] ? `${h["x-forwarded-for"]}, ${ip}` : ip;
  h["x-forwarded-proto"] ??= proto;
  if (headers.host) h["x-forwarded-host"] ??= headers.host;
  return h;
}

export function createProxy({ upstreams, timeoutMs = 5000, edge = true, proto = "http" }) {
  let next = 0;
  return http.createServer((req, res) => {
    const target = new URL(upstreams[next++ % upstreams.length]);
    const up = http.request({ host: target.hostname, port: target.port, method: req.method, path: req.url, headers: forwardHeaders(req.headers, { remote: req.socket.remoteAddress, proto, edge }) });
    const fail = (status, msg) => { if (!res.headersSent) { res.writeHead(status, { "content-type": "text/plain" }); res.end(msg); } else res.destroy(); };
    up.setTimeout(timeoutMs, () => { up.destroy(); fail(504, "gateway timeout"); });
    up.on("error", () => fail(502, "bad gateway"));
    up.on("response", (r) => { res.writeHead(r.statusCode, stripHopByHop(r.hea
…

$ node lab.js
مباشرة على الـ api من غير proxy، و header مزوّر: {"socket":"127.0.0.5","naive":"6.6.6.6","real":"127.0.0.5","proto":null,"secretHeader":"on"}
ورا proxy بيضيف على الـ header (edge: false):     {"socket":"127.0.0.1","naive":"6.6.6.6","real":"127.0.0.5","proto":"http","secretHeader":null}
ورا edge proxy بيكتب الـ header من الأول:         {"socket":"127.0.0.1","naive":"127.0.0.5","real":"127.0.0.5","proto":"https","secretHeader":null}
upstream أبطأ من الـ timeout: 504 gateway timeout
upstream واقع: 502 bad gateway
express و trust proxy false   : {"ip":"127.0.0.1","protocol":"http","secure":false}
express و trust proxy loopback: {"ip":"127.0.0.5","protocol":"https","secure":true}

// server.naive.js: الـ api بيقرا الـ client IP من الـ header على طول، وبيثق في أي X-Forwarded-Proto
import express from "express";

const app = express();
const hits = new Map(); // rate limit بالـ IP

app.use((req, res, next) => {
  const ip = String(req.headers["x-forwarded-for"] ?? req.socket.remoteAddress).split(",")[0].trim(); // أي حد يكتب أي IP
  const n = (hits.get(ip) ?? 0) + 1;
  hits.set(ip, n);
  if (n > 100) return res.status(429).end();
  next();
});

app.post("/login", (req, res) => {
  const secure = req.headers["x-forwarded-proto"] === "https"; // حتى لو الـ request جاي من بره الـ proxy خالص
  res.cookie("sid", "abc", { secure, httpOnly: true });
  res.json({ ok: true });
});

app.listen(3000, "0.0.0.0"); // مفتوح للعالم، فالـ proxy ممكن يتعدّى

# Caddyfile: TLS أوتوماتيك من Let's Encrypt، وتجديد لوحده، و HTTP ← HTTPS
shop.example.com {
    encode zstd gzip
    header Strict-Transport-Security "max-age=31536000; includeSubDomains"

    reverse_proxy api-1:3000 api-2:3000 {
        lb_policy round_robin
        health_uri /healthz
        health_interval 5s
        # Caddy بيكتب X-Forwarded-For من الأول، وبيبعت X-Forwarded-Proto و Host
    }
}

# nginx.conf: نفس الكلام بـ nginx
upstream api {
    server api-1:3000 max_fails=3 fail_timeout=10s;
    server api-2:3000 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

server {
    listen 80;
    server_name shop.example.com;
    return 301 https://$host$request_uri;          # HTTP ← HTTPS
}

server {
    listen 443 ssl;
    http2 on;
    server_name shop.example.com;
    ssl_certificate     /etc/letsencrypt/live/shop.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    client_max_body_size 10m;                     # الـ default واحد ميجا بس ← 413

    location / {
        proxy_pass http://api;
        proxy_http_version 1.1;
        proxy_set_header Connection "";           # keepalive مع الـ upstream
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;   # edge: من الأول، مش $proxy_add_x_forwarded_for
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 2s;
        proxy_read_timeout 30s;                   # أطول من أطول request عادي، وأقصر من صبر الـ user
    }

    location /ws {
        proxy_pass http://api;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;   # Upgrade و Connection hop-by-hop، فلازم تتبعت بإيدك
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 1h;                    # وإلا الـ WebSocket يتقفل بعد ستين ثانية سكوت
    }
}

// server.js: الـ api ورا proxy معروف بس
import express from "express";

const app = express();
// صدّق الـ X-Forwarded-* بس لو الـ request جاي من الـ proxy نفسه (الـ network بتاعة compose مثلًا)
app.set("trust proxy", ["loopback", "172.16.0.0/12"]); // أو رقم: عدد الـ proxies اللي قدامك بالضبط
// كده: req.ip هو الـ client الحقيقي، و req.protocol هو https لو الـ proxy قال كده، و req.secure

app.post("/login", (req, res) => {
  res.cookie("sid", "abc", { secure: true, httpOnly: true, sameSite: "lax" });
  res.json({ ok: true, ip: req.ip });
});

const server = app.listen(3000, "0.0.0.0"); // جُوّه الـ container، ومن غير ports: الـ proxy بس يوصله
// الـ keep-alive بتاع Node لازم يبقى أطول من بتاع الـ proxy، وإلا Node يقفل connection والـ proxy لسه بيبعت عليها ← 502 عشوائي
server.keepAliveTimeout = 65_000;
server.headersTimeout = 66_000;

// lab.js: client و proxy و api حقيقيين على الـ loopback. الـ client جاي من 127.0.0.5، والـ proxy على 127.0.0.1
import http from "node:http";
import express from "express";
import { createProxy, clientIp } from "./proxy.js";

const listen = (srv) => new Promise((ok) => srv.listen(0, "127.0.0.1", () => ok(srv.address().port)));
const api = http.createServer((req, res) => {
  if (req.url === "/slow") return setTimeout(() => res.end("متأخر"), 1500);
  res.setHeader("content-type", "application/json");
  res.end(JSON.stringify({
    socket: req.socket.remoteAddress,
    naive: String(req.headers["x-forwarded-for"] ?? req.socket.remoteAddress).split(",")[0].trim(), // أول IP في الـ header
    real: clientIp(req.headers["x-forwarded-for"], req.socket.remoteAddress, ["127.0.0.1/32"]),
    proto: req.headers["x-forwarded-proto"] ?? null,
    secretHeader: req.headers["x-internal-debug"] ?? null,
  }));
});
const apiPort = await listen(api);
const proxyPort = await listen(createProxy({ upstreams: [`http://127.0.0.1:${apiPort}`], timeoutMs: 500, proto: "https" }));
const appendPort = await listen(createProxy({ upstreams: [`http://127.0.0.1:${apiPort}`], timeoutMs: 500, edge: false }));
const deadPort = await listen(createProxy({ upstreams: ["http://127.0.0.1:1"], timeoutMs: 500 }));

const get = (port, path, headers = {}) => new Promise((ok, no) =>
  http.get({ host: "127.0.0.1", port, path, headers, localAddress: "127.0.0.5", agent: false }, (r) => {
    let body = ""; r.on("data", (c) => (body += c)); r.on("end", () => ok({ status: r.statusCode, body }));
  }).on("error", no));

const spoof = { "x-forwarded-for": "6.6.6.6", connection: "x-internal-debug", "x-internal-debug": "on" };
console.log("مباشرة على الـ api من غير proxy، و header مزوّر:", (await get(apiPort, "/", spoof)).body);
console.log("ورا proxy بيضيف على الـ header (edge: false):    ", (await get(appendPort, "/", spoof)).body);
console.log("ورا edge proxy بيكتب الـ header من الأول:        ", (await get(proxyPort, "/", spoof)).body);
const slow = await get(proxyPort, "/slow");
console.log(`upstream أبطأ من الـ timeout: ${slow.status} ${slow.body}`);
const dead = await get(deadPort, "/");
console.log(`upstream واقع: ${dead.status} ${dead.body}`);

// نفس الحكاية بـ Express: من غير trust proxy كل الـ users ليهم IP واحد، IP الـ proxy
for (const trust of [false, "loopback"]) {
  const app = express();
  app.set("trust proxy", trust);
  app.get("/", (req, res) => res.json({ ip: req.ip, protocol: req.protocol, secure: req.secure }));
  const port = await listen(http.createServer(app));
  const front = await listen(createProxy({ upstreams: [`http://127.0.0.1:${port}`], proto: "https" }));
  console.log(`express و trust proxy ${String(trust).padEnd(8)}: ${(await get(front, "/", spoof)).body}`);
}
process.exit(0);