fix: ignore https redirect for DERP meshing #10738
Conversation
|
Current dependencies on/for this PR: This stack of pull requests is managed by Graphite. |
243b6af to
1ab8293
Compare
1ab8293 to
da2112e
Compare
|
Feel free to take this over if there's any changes needed, or I can fix in the morning. |
| handler.ServeHTTP(w, r) | ||
| return | ||
| } | ||
| } |
There was a problem hiding this comment.
This ain't gonna work. We install this middleware at start of day, before we learn about any other replicas, and they change over time.
I think we should blanket refuse to redirect the path /derp. DERP is encrypted, so even if some client connection got the http URL for this path, it would be fine.
There was a problem hiding this comment.
How so? We're only looking at the redirect for ourself, so it doesn't matter which replicas come up or down, it'll always be the same host locally.
There was a problem hiding this comment.
No, you're right. I'm thinking about it the wrong way around. Sorry.
However, disabling the redirect for all routes on that host feels too broad. I think we generally do want to redirect for non-DERP routes if the request comes to e.g. our IP address or a non-cannonical hostname.
|
Closing in favor of #10752 |
No description provided.