fix: prevent infinite proxy loop with nonce-based detection #85
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When httpjail in server mode receives a request targeting itself, it now detects and blocks the loop using a unique nonce per proxy instance. Each proxy instance: - Generates a random nonce on startup - Appends its nonce to Httpjail-Loop-Prevention header (using HTTP's native multi-value header support) - Checks incoming requests for its own nonce and blocks with 403 if found This approach: - Supports chaining multiple httpjail instances - Works across network topologies (reverse proxies, Docker, etc.) - Uses HTTP standard multi-value headers instead of CSV parsing Also refactored code for DRY: - Created ProxyContext struct to bundle rule_engine, cert_manager, loop_nonce - Reduced function signature duplication throughout codebase - Extracted wait_for_server() helper to tests/common for reuse Test: New test_server_mode_self_request_loop_prevention verifies the fix, completing in ~0.3s (vs timing out without the fix).
The perform_tls_interception function uses CertificateManager::is_ca_trusted() on macOS but the import was missing from the main module (only present in tests). This caused compilation to fail on macOS CI. Added conditional import with #[cfg(target_os = "macos")] to match usage.
ammario
changed the title
- Convert wait_for_server() to async using tokio::time and tokio::net::TcpStream - Update all callers (start_server, start_server_with_bind, and tests) to async - Clean up self_request_loop test: remove verbose comments and println - Use tracing::debug for test debugging output - Simplify test assertions to focus on essential behavior
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #84
Problem
When httpjail runs in server mode and receives a request targeting itself (e.g.,
curl --proxy http://localhost:8080 http://localhost:8080/test), it creates an infinite loop.Solution
Implemented nonce-based loop detection:
Httpjail-Loop-Preventionheader on outgoing requestsChanges
ProxyContextstruct to bundle shared state (DRY refactoring)Benefits