Skip to content

v4.16.5

Choose a tag to compare

View all tags
@vishr vishr released this 15 Nov 05:17
Immutable release. Only release title and notes can be modified.
v4.16.5
1a99655
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Proxy middleware: a client could remove X-Forwarded-Proto from the upstream request by naming it in the Connection header, on plain HTTP requests and WebSocket upgrades. The proxy now sets X-Forwarded-Proto again after Go removes hop-by-hop headers, as it already does for X-Real-IP. Fixes GHSA-h6x5-phvw-c55c. Reported by zachary-satterly.

Behavior change

A custom balancer that replaces the request and sets its own X-Forwarded-Proto no longer reaches the upstream with that value; the proxy uses the scheme of the original request. A custom ProxyConfig.Transport can still set the header.

No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.

Assets 3
Loading