func Handle404(w http.ResponseWriter, r *http.Request) { err := model.NewLocAppError("Handle404", "api.context.404.app_error", nil, "") err.Translate(utils.T) err.StatusCode = http.StatusNotFound l4g.Debug("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r)) if IsApiCall(r) { w.WriteHeader(err.StatusCode) err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'. Typo? are you missing a team_id or user_id as part of the url?" w.Write([]byte(err.ToJson())) } else { RenderWebError(err, w, r) } }
func (h handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { now := time.Now() l4g.Debug("%v", r.URL.Path) c := &Context{} c.T, c.Locale = utils.GetTranslationsAndLocale(w, r) c.RequestId = model.NewId() c.IpAddress = utils.GetIpAddress(r) c.TeamId = mux.Vars(r)["team_id"] token := "" isTokenFromQueryString := false // Attempt to parse token out of the header authHeader := r.Header.Get(model.HEADER_AUTH) if len(authHeader) > 6 && strings.ToUpper(authHeader[0:6]) == model.HEADER_BEARER { // Default session token token = authHeader[7:] } else if len(authHeader) > 5 && strings.ToLower(authHeader[0:5]) == model.HEADER_TOKEN { // OAuth token token = authHeader[6:] } // Attempt to parse the token from the cookie if len(token) == 0 { if cookie, err := r.Cookie(model.SESSION_COOKIE_TOKEN); err == nil { token = cookie.Value if (h.requireSystemAdmin || h.requireUser) && !h.trustRequester { if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML { c.Err = model.NewLocAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt") token = "" } } } } // Attempt to parse token out of the query string if len(token) == 0 { token = r.URL.Query().Get("access_token") isTokenFromQueryString = true } if utils.GetSiteURL() == "" { protocol := GetProtocol(r) c.SetSiteURL(protocol + "://" + r.Host) } w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId) w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v", model.CurrentVersion, model.BuildNumber, utils.CfgHash)) if einterfaces.GetClusterInterface() != nil { w.Header().Set(model.HEADER_CLUSTER_ID, einterfaces.GetClusterInterface().GetClusterId()) } // Instruct the browser not to display us in an iframe unless is the same origin for anti-clickjacking if !h.isApi { w.Header().Set("X-Frame-Options", "SAMEORIGIN") w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'") } else { // All api response bodies will be JSON formatted by default w.Header().Set("Content-Type", "application/json") if r.Method == "GET" { w.Header().Set("Expires", "0") } } if len(token) != 0 { session, err := app.GetSession(token) if err != nil { l4g.Error(utils.T("api.context.invalid_session.error"), err.Error()) c.RemoveSessionCookie(w, r) if h.requireUser || h.requireSystemAdmin { c.Err = model.NewLocAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token) c.Err.StatusCode = http.StatusUnauthorized } } else if !session.IsOAuth && isTokenFromQueryString { c.Err = model.NewLocAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token) c.Err.StatusCode = http.StatusUnauthorized } else { c.Session = *session } } if h.isApi || h.isTeamIndependent { c.setTeamURL(c.GetSiteURL(), false) c.Path = r.URL.Path } else { splitURL := strings.Split(r.URL.Path, "/") c.setTeamURL(c.GetSiteURL()+"/"+splitURL[1], true) c.Path = "/" + strings.Join(splitURL[2:], "/") } if c.Err == nil && h.requireUser { c.UserRequired() } if c.Err == nil && h.requireMfa { c.MfaRequired() } if c.Err == nil && h.requireSystemAdmin { c.SystemAdminRequired() } if c.Err == nil && h.isUserActivity && token != "" && len(c.Session.UserId) > 0 { app.SetStatusOnline(c.Session.UserId, c.Session.Id, false) } if c.Err == nil && (h.requireUser || h.requireSystemAdmin) { //check if teamId exist c.CheckTeamId() } if c.Err == nil { h.handleFunc(c, w, r) } // Handle errors that have occoured if c.Err != nil { c.Err.Translate(c.T) c.Err.RequestId = c.RequestId c.LogError(c.Err) c.Err.Where = r.URL.Path // Block out detailed error when not in developer mode if !*utils.Cfg.ServiceSettings.EnableDeveloper { c.Err.DetailedError = "" } if h.isApi { w.WriteHeader(c.Err.StatusCode) w.Write([]byte(c.Err.ToJson())) if einterfaces.GetMetricsInterface() != nil { einterfaces.GetMetricsInterface().IncrementHttpError() } } else { if c.Err.StatusCode == http.StatusUnauthorized { http.Redirect(w, r, c.GetTeamURL()+"/?redirect="+url.QueryEscape(r.URL.Path), http.StatusTemporaryRedirect) } else { RenderWebError(c.Err, w, r) } } } if h.isApi && einterfaces.GetMetricsInterface() != nil { einterfaces.GetMetricsInterface().IncrementHttpRequest() if r.URL.Path != model.API_URL_SUFFIX+"/users/websocket" { elapsed := float64(time.Since(now)) / float64(time.Second) einterfaces.GetMetricsInterface().ObserveHttpRequestDuration(elapsed) } } }
func (m *VaryBy) Key(r *http.Request) string { return utils.GetIpAddress(r) }
func StartServer() { l4g.Info(utils.T("api.server.start_server.starting.info")) var handler http.Handler = &CorsWrapper{Srv.Router} if *utils.Cfg.RateLimitSettings.Enable { l4g.Info(utils.T("api.server.start_server.rate.info")) store, err := memstore.New(utils.Cfg.RateLimitSettings.MemoryStoreSize) if err != nil { l4g.Critical(utils.T("api.server.start_server.rate_limiting_memory_store")) return } quota := throttled.RateQuota{ MaxRate: throttled.PerSec(utils.Cfg.RateLimitSettings.PerSec), MaxBurst: *utils.Cfg.RateLimitSettings.MaxBurst, } rateLimiter, err := throttled.NewGCRARateLimiter(store, quota) if err != nil { l4g.Critical(utils.T("api.server.start_server.rate_limiting_rate_limiter")) return } httpRateLimiter := throttled.HTTPRateLimiter{ RateLimiter: rateLimiter, VaryBy: &VaryBy{}, DeniedHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { l4g.Error("%v: Denied due to throttling settings code=429 ip=%v", r.URL.Path, utils.GetIpAddress(r)) throttled.DefaultDeniedHandler.ServeHTTP(w, r) }), } handler = httpRateLimiter.RateLimit(handler) } Srv.GracefulServer = &graceful.Server{ Timeout: TIME_TO_WAIT_FOR_CONNECTIONS_TO_CLOSE_ON_SERVER_SHUTDOWN, Server: &http.Server{ Addr: utils.Cfg.ServiceSettings.ListenAddress, Handler: handlers.RecoveryHandler(handlers.PrintRecoveryStack(true))(handler), ReadTimeout: time.Duration(*utils.Cfg.ServiceSettings.ReadTimeout) * time.Second, WriteTimeout: time.Duration(*utils.Cfg.ServiceSettings.WriteTimeout) * time.Second, }, } l4g.Info(utils.T("api.server.start_server.listening.info"), utils.Cfg.ServiceSettings.ListenAddress) if *utils.Cfg.ServiceSettings.Forward80To443 { go func() { listener, err := net.Listen("tcp", ":80") if err != nil { l4g.Error("Unable to setup forwarding") return } defer listener.Close() http.Serve(listener, http.HandlerFunc(redirectHTTPToHTTPS)) }() } go func() { var err error if *utils.Cfg.ServiceSettings.ConnectionSecurity == model.CONN_SECURITY_TLS { if *utils.Cfg.ServiceSettings.UseLetsEncrypt { var m letsencrypt.Manager m.CacheFile(*utils.Cfg.ServiceSettings.LetsEncryptCertificateCacheFile) tlsConfig := &tls.Config{ GetCertificate: m.GetCertificate, } tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2") err = Srv.GracefulServer.ListenAndServeTLSConfig(tlsConfig) } else { err = Srv.GracefulServer.ListenAndServeTLS(*utils.Cfg.ServiceSettings.TLSCertFile, *utils.Cfg.ServiceSettings.TLSKeyFile) } } else { err = Srv.GracefulServer.ListenAndServe() } if err != nil { l4g.Critical(utils.T("api.server.start_server.starting.critical"), err) time.Sleep(time.Second) } }() }