Reverse Proxy using coraza response status 302 sending with 200 statusOK

[Nihilistttt]

Hello everyone,

I'm using coraza with my reverse proxy application. When I use http.wraphandler with my response and request, server sends location header and 302 status code. I don't know why but at the end of the wraphandler status code changing into 200 and client gets 200 so It will not redirect it into new location.
I really preciate any help.
Server side : Nginx + WordPress
example link who wants to try http://examplesite.com/wp-admin/
this link sends 302 but client side (web browser) gets 200

[jcchavezs]

Hi @Nihilistttt I don't fully get the context. Are you using the net/http wrapper? If so, how do you deploy it in front of your server?

[Nihilistttt]

I use coraza/v3/http http.wraphandler,
in http server ServeHTTP function I call it with reverseproxy
something like this

txhttp.WrapHandler(waf, reverseProxy).ServeHTTP(w, r)
it will get response from origin server and send it to coraza and coraza send it to client.
All of them working well until now, New installed test server working Wordpress on it, response status code automatically changing when response sending to client.
Just difference I realized in response header there is different header from other wordpress sites.
"Using Stream ID:1 (easy handle .....)
is it possible origin server response body not closed.

[jcchavezs]

When you say "reverseproxy" you mean https://go.dev/src/net/http/httputil/reverseproxy.go ? If so, could you make a simple code pointing to httpbin http://httpbin.org/? Are you using https?

[Nihilistttt]

package main

import (
"crypto/tls"
"fmt"
"log"
"net/http"
"net/http/httputil"

"github.com/corazawaf/coraza/v3"
txhttp "github.com/corazawaf/coraza/v3/http"

)

type customProxy struct {
Transport http.RoundTripper
Proxy *httputil.ReverseProxy
Waf coraza.WAF
}

func main() {
reverseProxy := new(customProxy)

http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
http.DefaultTransport.(*http.Transport).MaxIdleConns = 1000
http.DefaultTransport.(*http.Transport).MaxIdleConnsPerHost = 1000

reverseProxy.Transport = http.DefaultTransport
reverseProxy.Proxy = NewReverseProxy(reverseProxy)

waf, err := coraza.NewWAF(
	coraza.NewWAFConfig().
		WithDirectives("Include ./coraza.conf").
		WithDirectives("Include ./crs-setup.conf"),
)
if err != nil {
	log.Fatalln(err.Error())
}
reverseProxy.Waf = waf

tlsconfig := &tls.Config{
	InsecureSkipVerify: false,
	GetCertificate:     GetCertificate,
}
newServer := &http.Server{
	Addr:      ":443",
	TLSConfig: tlsconfig,
	Handler:   reverseProxy,
}

newServer.ListenAndServeTLS("", "")

}

func GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
certificate, err := tls.LoadX509KeyPair("./localhost.crt", "./localhost.key")
if err == nil {
return &certificate, nil
}
return nil, err
}

func NewReverseProxy(transport http.RoundTripper) *httputil.ReverseProxy {
return &httputil.ReverseProxy{
Transport: transport,
Director: func(request *http.Request) {
},
ModifyResponse: func(response *http.Response) error {
response.Header.Set("Server", "MyServer")
return nil
},
}
}

func (s *customProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
txhttp.WrapHandler(s.Waf, s.Proxy).ServeHTTP(w, r)
}

func (s *customProxy) RoundTrip(req *http.Request) (*http.Response, error) {
req.URL.Scheme = "https"

if req.Host == "httpbin.org" {
	req.URL.Host = "54.175.144.50"
	req.Host = "httpbin.org"
} else {
	req.URL.Host = "69.164.201.47"
	req.Host = "topiks.net"
}

res, err := s.Transport.RoundTrip(req)
fmt.Println("transport Status Code :", res.StatusCode)
return res, err

}

//for httpbin.org: curl -k -v https://localhost/status/302 -H "Host:httpbin.org"
//for topiks.net: curl -k -v https://localhost/wp-admin/ -H "Host:topiks.net"

httbin response

curl https://localhost/status/302 -v -k -H "Host:httpbin.org"

• Trying 127.0.0.1:443...
• Connected to localhost (127.0.0.1) port 443 (#0)
• ALPN: offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
• ALPN: server accepted h2
• Server certificate:
• subject: CN=localhost
• start date: Apr 20 09:01:18 2023 GMT
• expire date: May 20 09:01:18 2023 GMT
• issuer: CN=localhost
• SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
• using HTTP/2
• h2 [:method: GET]
• h2 [:scheme: https]
• h2 [:authority: httpbin.org]
• h2 [:path: /status/302]
• h2 [user-agent: curl/8.1.2]
• h2 [accept: /]
• Using Stream ID: 1 (easy handle 0x146013400)

GET /status/302 HTTP/2
Host:httpbin.org
User-Agent: curl/8.1.2
Accept: /

< HTTP/2 302
< access-control-allow-credentials: true
< access-control-allow-origin: *
< date: Wed, 06 Sep 2023 21:25:18 GMT
< location: /redirect/1
< server: MyServer
< content-length: 0
<

• Connection #0 to host localhost left intact

for topiks.net

curl https://localhost/wp-admin/ -v -k -H "Host:topiks.net"

• Trying 127.0.0.1:443...
• Connected to localhost (127.0.0.1) port 443 (#0)
• ALPN: offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
• ALPN: server accepted h2
• Server certificate:
• subject: CN=localhost
• start date: Apr 20 09:01:18 2023 GMT
• expire date: May 20 09:01:18 2023 GMT
• issuer: CN=localhost
• SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
• using HTTP/2
• h2 [:method: GET]
• h2 [:scheme: https]
• h2 [:authority: topiks.net]
• h2 [:path: /wp-admin/]
• h2 [user-agent: curl/8.1.2]
• h2 [accept: /]
• Using Stream ID: 1 (easy handle 0x14080bc00)

GET /wp-admin/ HTTP/2
Host:topiks.net
User-Agent: curl/8.1.2
Accept: /

< HTTP/2 200
< cache-control: no-cache, must-revalidate, max-age=0
< content-type: text/html; charset=UTF-8
< date: Wed, 06 Sep 2023 21:19:20 GMT
< expires: Wed, 11 Jan 1984 05:00:00 GMT
< location: https://topiks.net/wp-login.php?redirect_to=https%3A%2F%2Ftopiks.net%2Fwp-admin%2F&reauth=1
< server: MyServer
< x-redirect-by: WordPress
<

• Connection #0 to host localhost left intact

[Nihilistttt]

I fixed the problem, I guess it is littke bit related with coraza. it was related with reverse proxy and content-lenght. So I dont know where but coraza not properly copying header and status code. So flushing with http.StatusOK
I also realized, rwInterceptor.w not correct value in it. rws (responsewriterstate.status = 0). if I disable wraphandler, status = 302

At last:
I found missing part missing part, in responsewrite(rwinterceptor) does'nt set i.w.WriteHeader(statuscode) so returning response writer doesn't have status value

func (i *rwInterceptor) WriteHeader(statusCode int) {
if i.wroteHeader {
log.Println("http: superfluous response.WriteHeader call")
return
}

for k, vv := range i.w.Header() {
	for _, v := range vv {
		i.tx.AddResponseHeader(k, v)
	}
}

i.statusCode = statusCode
//this line must be set
    i.w.WriteHeader(statusCode)
if it := i.tx.ProcessResponseHeaders(statusCode, i.proto); it != nil {
	i.Header().Set("Content-Length", "0")
	i.statusCode = obtainStatusCodeFromInterruptionOrDefault(it, i.statusCode)
	i.flushWriteHeader()
	return
}

i.wroteHeader = true

}