Namesys is a very useful submodule. Given a ValueStore and a Datastore it can
resolve and publish /ipns/ paths.
This functionality does not need to be sequestered inside go-ipfs as it can
and should be used without IPFS, for example, for implementing lightweight
IPNS publishing services or for resolving /ipns/ paths.
"keystore" extraction was necessary, as there is a dependency to it in
namesys. Keystore is also a useful module by itself within the stack.
Fixes#6537
We used Clear-Site-Data to cushion transition period for local gateway
exposed at http://localhost while we were still figuring out
security-related details.
In the final implementation subdomain gateways are not tied to a
hostname explicitly, which removes the risk of cookies leaking,
removing the need for the header.
Turns out it causes issues for Firefox users, so let's just remove it.
Closes https://github.com/ipfs-shipyard/ipfs-companion/issues/977
This adds localhost ipv6 addresses to the allowlist for use in browser
context and fixes WebUI on ipv6-only deployments: http://[::1]:5001/webui
We were missing CORS/Origin tests for API port so I've added basic ones
and included localhost/127.0.0.1/::1 variants.
This adds proper end-to-end tests for directory listing on Gateway port
that protects us against regressions oni each gw type:
- path gateway
- subdomain gateway
- dnslink website gateway
Tests cover:
- etag/unicode support
- breadcrumbs
- file name column
- hash column
This implements 'attachment' mode triggered then
?filename parameter is accompanied with &download=true
When Content-Disposition: attachment is detected by a modern browser
it will skip rendering and immediately open the "save as" dialog,
making this useful feature for using IPFS gateway as target of
"Download" links on various websites.
Parameter name was suggested in:
https://github.com/ipfs/go-ipfs/pull/4177#issuecomment-414870327
These changes are needed to prepare for the Directory page UI improvements
implemented in https://github.com/ipfs/dir-index-html/issues/37.
- update dir-index-html type structs
- emit gateway URL for root links
- emit CID of each directoryItem
- emit size of directory
- emit breadcrumbs
This ensures implicit defaults are always present, even when
Gateway.PublicGateways is defined in the config.
User still can disable them, but needs to do it per hostname.
License: MIT
Signed-off-by: Marcin Rataj <lidel@lidel.org>
Add support for one or more wildcards in the hostname definition
of a public gateway. This is useful for example to support easily
multiples environment.
Wildcarded hostname are set in the config as for example "*.domain.tld".
While the content of raw files retrieved via the gateway should never
change, the look and feel of the directory index can and will change
between versions of go-ipfs.
Incorporate the hash of assets/bindata.go into the ETag when appropriate
fixes https://github.com/ipfs/go-ipfs/pull/4233#issuecomment-631454543
Basically, there's a trade-off here:
1. We can support directory listings while supporting 404 pages (this PR).
2. If a 404 page is present, directory listings don't work.
Given that option 1 is more flexible and users shouldn't be _too_ confused if
they land on a directory with no index.html page, I've gone with that option.
Files already have an explicit Content-Type set. Be sure to do this for
directory listings as well to avoid a fallback to autodetection in
net/http. That fallback fails when a ResponseWriter is installed that
performs compression.
In the same way that an `index.html` file is rendered, if one is present, when the
requested path is a directory, now an `ipfs-404.html` file is rendered if
the requested file is not present within the specified IPFS object.
`ipfs-404.html` files are looked for in the directory of the requested path and each
parent until one is found, falling back on the well-known 404 error message.
License: MIT
Signed-off-by: JP Hastings-Spital <jphastings@gmail.com>
This commit upgrades go-ipfs-cmds and configures the commands HTTP API Handler
to only allow POST/OPTIONS, disallowing GET and others in the handling of
command requests in the IPFS HTTP API (where before every type of request
method was handled, with GET/POST/PUT/PATCH being equivalent).
The Read-Only commands that the HTTP API attaches to the gateway endpoint will
additional handled GET as they did before (but stop handling PUT,DELETEs).
By limiting the request types we address the possibility that a website
accessed by a browser abuses the IPFS API by issuing GET requests to it which
have no Origin or Referrer set, and are thus bypass CORS and CSRF protections.
This is a breaking change for clients that relay on GET requests against the
HTTP endpoint (usually :5001). Applications integrating on top of the
gateway-read-only API should still work (including cross-domain access).
Co-Authored-By: Steven Allen <steven@stebalien.com>
Co-Authored-By: Marcin Rataj <lidel@lidel.org>
When request is sent to http://localhost:8080/ipfs/$cid response has
HTTP 301 status code and "Location" header with redirect destination at
$cid.ipfs.localhost:8080
Redirect is followed by browsersi, but not by commandline tools.
Status 301 is ignored by curl in default mode: it will print response
and won't follow redirect, user needs to add -L for that.
To fix curl, we return correct payload in body of HTTP 301 response,
but set Clear-Site-Data header to ensure Origin sandbox can't be abused.
This requires a surgical workaround:
If Location header is present in ResponseWriter's Header map,
we ensure http.ServeContent() returns HTTP 301
Context: https://github.com/ipfs/go-ipfs/pull/6982
License: MIT
Signed-off-by: Marcin Rataj <lidel@lidel.org>
Instead of adding a new fake header (that could be spoofed by the client...),
just read the original request URI from the request object.
This also removes support for suborigins. They have never been implemented in
browsers and it looks like efforts have stalled. We can add support back if we
need it but, well, maintaining support was going to be more trouble than it was
worth.
License: MIT
Signed-off-by: Steven Allen <steven@stebalien.com>
We've deprecated this system and have yet to move to a new system. We might as
well remove everything, switch to a new system, then deliberately trace the
entire system.
1. Require files to have known sizes. We can add support for unknown sizes
_later_ but we can't use ServeContent for those files.
2. Replace the `sizeReadSeeker` with a `lazySeeker`. This one makes no
assumptions about how it's used so we're less likely to run into weird bugs.
1. Fix handling of PUT. The simple implementation was the correct
implementation, I have no idea what was going on here.
2. Use MFS everywhere to reduce code duplication and add support for sharded
directories.
3. _Correctly_ block IPNS.
4. Remove the dependency on `core.IpfsNode`.
5. Remove support for putting empty directories with a well-known CID. It was
useless as directories are automatically created.
Most of these are probably harmless but a few looked like they might actually be
bugs. Most of them are just faulty tests.
License: MIT
Signed-off-by: Steven Allen <steven@stebalien.com>
1. They don't _have_ to be mutually exclusive.
2. local, mode, etc is _really_ confusing.
License: MIT
Signed-off-by: Steven Allen <steven@stebalien.com>
* Updates go-ipfs-cmds to try to get the tests to pass on travis.
* While we're at it, fix duplicate gx deps.
License: MIT
Signed-off-by: Steven Allen <steven@stebalien.com>
