Forcing 404 or 302 on certain fixed upstream paths

Help
1

1. Caddy version (caddy version):

v2.4.6 h1:HGkGICFGvyrodcqOOclHKfvJC0qTU7vny/7FhYp9hNw=

2. How I run Caddy:

a. System environment:

Docker

(strip-www) {
    @www.{args.0} host www.{args.0}
    redir @www.{args.0} https://{args.0}{uri}
}

(common-tls-example) {
    tls let_admin@example.com

    # HSTS (63072000 seconds)
    header Strict-Transport-Security "max-age=63072000"
}

www.example.com:443 {
    import strip-www example.com
    import common-tls-example
}

example.com:443 {
    reverse_proxy http://internal_app:65
    import common-tls-example
}

I am serving an application (internal_app) at https://example.com/
I didn’t write this application and the page at https://example.com/should-be-inaccessible/?dm=this-doesnt-matter should be inaccessible to the user (and return a 404 or 302 to /). There are 2 ways I can think of this path being created:

  1. accessed by the user (saved bookmark or history etc)
  2. generated by the application (eg: if user logs out, under certain scenarios, the app sends them to this page)

This is an update/fix that should be made in the application but until that’s done, I want to work around it. Is this possible through caddyfile?

I was reading the docs and I think it should be using the path matcher:

… but I am struggling to write the path matcher stanza.

  1. Is there a way to redir to / in case of 1 or 2?
  2. If not, atleast return a 404?
2

You can either do:

redir /some-path* /

or:

respond /some-path* 404
2 Likes
3

Ok, so updating the last stanza to:

example.com:443 {
    reverse_proxy http://internal_app:65
    import common-tls-example

    redir /should-be-inaccessible* /

}

Will have the following behavior:

  1. If the user tries to access:

https://example.com/should-be-inaccessible/?dm=this-doesnt-matter

They will be sent back to https://example.com/

  1. If the application was ever to expose this path to the user (like a redir on its own), the user won’t even notice the https://example.com/should-be-inaccessible path (it won’t show up in their browser history etc)?
4

Yes

They could see the path. Caddy can’t control browser history.

1 Like
5

This topic was automatically closed after 30 days. New replies are no longer allowed.