41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
id: http-sanitize-headers-basic
|
|
name: Sanitize risky forwarding headers
|
|
protocol: http
|
|
description: Removes a few risky forwarding headers before the request is sent upstream.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- rewrite
|
|
- headers
|
|
- web
|
|
action: rewrite
|
|
summary: Removes a few risky forwarding headers before the request is sent upstream.
|
|
behavior: Deletes selected override or forwarding headers and logs what was rewritten
|
|
without blocking the request.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import http
|
|
|
|
STRIP_HEADERS = (
|
|
"x-forwarded-host",
|
|
"x-http-method-override",
|
|
"x-original-url",
|
|
"x-rewrite-url",
|
|
)
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
removed = []
|
|
for header in STRIP_HEADERS:
|
|
if header in flow.request.headers:
|
|
removed.append(header)
|
|
del flow.request.headers[header]
|
|
if removed:
|
|
logging.info(
|
|
"[http-sanitize-headers-basic] stripped headers=%s url=%s",
|
|
",".join(removed),
|
|
flow.request.pretty_url,
|
|
)
|