Merge pull request #61 from Progmasoft/security/cloudflare-real-ipHEADmain

Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c

1 files changed, 25 insertions, 12 deletions

diff --git a/ops/nginx/progmaweb.conf b/ops/nginx/progmaweb.conf
index f5bdddc..f752b80 100644
--- a/ops/nginx/progmaweb.conf
+++ b/ops/nginx/progmaweb.conf
@@ -1,6 +1,19 @@
 # SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
 # SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
 
+# Only a WebSocket upgrade reaches the applications. Forwarding any Upgrade
+# header with "Connection: upgrade" on every request would let a client ask an
+# upstream for another protocol (h2c) behind Nginx.
+map $http_upgrade $progmaweb_upgrade {
+    default   "";
+    ~*^websocket$ websocket;
+}
+
+map $progmaweb_upgrade $progmaweb_connection {
+    default   "";
+    websocket upgrade;
+}
+
 server {
     listen 80;
     listen [::]:80;
@@ -87,8 +100,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -122,8 +135,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -206,8 +219,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -271,8 +284,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -337,8 +350,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }
@@ -399,8 +412,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
+        proxy_set_header Upgrade $progmaweb_upgrade;
+        proxy_set_header Connection $progmaweb_connection;
         proxy_read_timeout 60s;
     }
 }