Caddy-Reverse_Proxy
/
caddy
mirror of https://github.com/caddyserver/caddy
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
caddy/modules/caddyhttp
History
Venkatesh Panda b01a31c635
caddyauth: Don't write into shared hash buffer when building cache key (#8278) 
HTTPBasicAuth.correctPassword built its hash cache key with
append(account.password, plaintextPassword...). account.password is
shared by all requests and can have spare capacity, so short passwords
were written into the stored hash's backing array, causing a data race
between concurrent requests and potentially mixed-up cache keys.

Build the key in a fresh buffer instead, and add regression tests.

(cherry picked from commit f89626aa55)
 		2026-11-03 18:25:44 -05:00
..
caddyauth caddyauth: Don't write into shared hash buffer when building cache key (#8278) 2026-11-03 18:25:44 -05:00
encode encode: use httpguts to look for Accept-Encoding in Vary (#8329) 2026-11-03 00:53:50 -05:00
fileserver fileserver: handle empty files in size try policies (#8322) 2026-11-03 18:21:22 -05:00
headers headers: evaluate conditional defaults independently (#8217) 2026-11-03 00:53:18 -05:00
intercept intercept: fix misleading handle_response error for extra matcher args (#7871) 2026-07-12 09:16:34 +10:00
logging
…
map map: reject malformed destination placeholders (#8074) 2026-09-28 22:19:51 +10:00
proxyprotocol
…
push chore: Dumb `prealloc` lint fix (#7430) 2026-01-13 14:13:43 -05:00
requestbody requestbody: enforce max_size early using Content-Length (#8337) 2026-11-03 18:25:44 -05:00
reverseproxy reverseproxy: skip unavailable upstream with a single weighted_round_robin weight (#8320) 2026-11-03 18:21:22 -05:00
rewrite rewrite: treat only valid percent encodings as escapes (#8345) 2026-11-03 18:21:22 -05:00
standard caddyhttp: mitigate slowloris via idle read/write deadlines (#7913) 2026-08-21 21:17:26 -06:00
templates templates: use the earliest front matter closing fence (#8259) 2026-11-03 00:53:19 -05:00
timeouts caddyhttp: only bound HTTP/2 body reads in flight with the idle timeout (#8125) 2026-11-03 00:53:03 -05:00
tracing tracing: fix BatchSpanProcessor goroutine leak on config reload (#7826) 2026-06-18 11:42:58 -06:00
app.go fastcgi: keep the php_fastcgi directory redirect on the same origin (#8285) 2026-11-03 00:53:19 -05:00
app_test.go caddyhttp: wait for servers from previous configs on exit (#8009) 2026-09-30 11:15:18 -06:00
autohttps.go tls: add alpn to managed HTTPS records (#7653) 2026-05-10 13:10:29 +10:00
autohttps_test.go tls: add alpn to managed HTTPS records (#7653) 2026-05-10 13:10:29 +10:00
caddyhttp.go
…
caddyhttp_test.go
…
celmatcher.go caddyhttp: Reject repeated expression matchers in a matcher set (#8183) 2026-11-03 00:53:04 -05:00
celmatcher_test.go caddyhttp: add CEL expression support to the tls matcher (#8088) 2026-11-03 00:53:19 -05:00
errors.go build: bump all dependencies - (Go 1.26 floor) (#8056) 2026-09-30 10:54:12 -06:00
errors_randstring_test.go caddyhttp: fix randString sameCase dictionary to match its docs (#7972) 2026-09-25 16:01:50 +00:00
http2listener.go chore: clean up wording and typo fixes (#7745) 2026-05-20 16:36:30 +10:00
httpredirectlistener.go chore: clean up wording and typo fixes (#7745) 2026-05-20 16:36:30 +10:00
idletimeout.go caddyhttp: let handler read deadlines cap the idle read timeout (#8284) 2026-11-03 00:53:41 -05:00
idletimeout_test.go caddyhttp: let handler read deadlines cap the idle read timeout (#8284) 2026-11-03 00:53:41 -05:00
incremental.go feat: implement the Incremental header field (RFC 10036) (#8020) 2026-10-02 20:59:34 -04:00
incremental_test.go feat: implement the Incremental header field (RFC 10036) (#8020) 2026-10-02 20:59:34 -04:00
invoke.go
…
ip_matchers.go chore(deps): bump cel-go and switch import to new url (#8030) 2026-09-17 04:09:23 +03:00
ip_range.go
…
logging.go httpcaddyfile: Add log_level directive for access logs (#8201) 2026-11-03 00:53:10 -05:00
logging_test.go caddyhttp: ignore case when matching hosts in logger_names (#8176) 2026-11-03 00:53:04 -05:00
marshalers.go admin: Redact sensitive request headers in API logs (#7578) 2026-04-17 14:56:42 -06:00
matchers.go caddyhttp: correct path matcher doc on bare trailing wildcards (#8006) 2026-11-03 18:21:22 -05:00
matchers_test.go caddyhttp: correct path matcher doc on bare trailing wildcards (#8006) 2026-11-03 18:21:22 -05:00
metrics.go build: bump all dependencies - (Go 1.26 floor) (#8056) 2026-09-30 10:54:12 -06:00
metrics_test.go metrics: Implement pushing via OLTP (#7664) 2026-04-25 06:52:08 -04:00
replacer.go fastcgi: keep the php_fastcgi directory redirect on the same origin (#8285) 2026-11-03 00:53:19 -05:00
replacer_test.go caddyhttp: keep absent optional placeholders empty (#8019) 2026-10-03 01:54:13 +00:00
responsematchers.go
…
responsematchers_test.go
…
responsewriter.go
…
responsewriter_test.go
…
routes.go caddyhttp: skip matchers for satisfied route groups (#8189) 2026-11-03 00:53:04 -05:00
server.go caddyhttp: reject invalid and dots-only hosts on every protocol (#8328) 2026-11-03 18:21:22 -05:00
server_test.go caddyhttp: reject invalid and dots-only hosts on every protocol (#8328) 2026-11-03 18:21:22 -05:00
staticerror.go
…
staticresp.go caddyhttp: only replace known placeholders in respond headers (#8014) 2026-09-13 12:08:21 +10:00
staticresp_test.go caddyhttp: keep absent optional placeholders empty (#8019) 2026-10-03 01:54:13 +00:00
subroute.go
…
urlpatternmatcher.go chore(deps): bump cel-go and switch import to new url (#8030) 2026-09-17 04:09:23 +03:00
urlpatternmatcher_test.go caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal (#7941) 2026-08-15 10:38:20 -06:00
vars.go caddyhttp: use errors.AsType for request body limit errors (#8090) 2026-09-30 13:50:42 -06:00
vars_test.go caddyhttp: surface 413 for oversized request body placeholders (#7969) 2026-09-25 22:27:19 +10:00