#!/usr/bin/python3 from flask import Flask, request, redirect import requests as r app = Flask(__name__) proxy_node_port = 5000 static_node_port = 5001 logic_node_port = 5003 content_node_port = 5004 static_node = "static:" + str(static_node_port) logic_node = "logic:" + str(logic_node_port) content_node = "content:" + str(content_node_port) @app.route('/', defaults={'path': 'index.html'}) @app.route('/', methods=["GET", "POST"]) def catch_all(path: str): print(path) ext = path.split('.')[-1] if ext == "html": resp = r.get(f"http://{content_node}/{path}?{request.full_path.split('?')[1]}", headers=request.headers) return resp.content, resp.status_code, resp.headers.items() if ext in ["css", "png", "jpg", "ico", "js", "otf", "eot", "svg", "ttf", "woff", "woff2"]: resp = r.get(f"http://{static_node}/{path}", stream=True) headers = [("Cache-Control", "max-age=36000;"), ("Content-Type", resp.headers["Content-Type"])] return resp.content, resp.status_code, headers if path.startswith("api/"): if request.method.lower() not in ("get", "post"): return redirect("/", code=302) passcall = getattr(r, request.method.lower()) # PATCH V3: allow_redirects=False. requests по умолчанию ХОДИТ по Location, # который отдаёт logic, а Location раньше строился из заголовка Origin => # proxy делал запрос во внутреннюю сеть за атакующего (SSRF). # Редирект теперь отдаём клиенту, а не отрабатываем сами. resp = passcall(f"http://{logic_node}/{path[4:]}", json=request.get_json(silent=True), headers=request.headers, allow_redirects=False) return resp.content, resp.status_code, resp.headers.items() return redirect("/", code=302) if __name__ == '__main__': app.run(host="0.0.0.0", port=proxy_node_port)