administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-15 11:12:49 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Match go2rtc stream-proxy paths the way nginx does

Browse Source 
/auth compared the raw $request_uri path against the three go2rtc
stream-proxy paths exactly, while nginx matches its prefix locations
against the normalized URI. Encoded characters, repeated slashes, dot
segments or a suffix on the path skipped the stream check even though
nginx still proxied the request to go2rtc.

The go2rtc stream locations now set a variable that the auth subrequest
forwards as X-Go2rtc-Stream-Proxy (client headers are not forwarded, so it
cannot be spoofed). As a fallback, /auth also normalizes the path like
nginx (percent-decoding, merging slashes, resolving dot segments) and
prefix matches it, and splits the raw URI by hand since urlparse reads a
leading // as a host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Blake Blackshear
2026-10-14 08:43:35 -05:00
co-authored by Claude Opus 5.5
parent 9b165948c3
commit fab41048a1
4 changed files with 89 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/main/rootfs/usr/local/nginx/conf/auth_location.conf
+3
View File
@@ -15,6 +15,9 @@ location /auth {
# Pass info about the request
proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Original-URL $request_uri;
# set by the go2rtc stream locations; client headers are not forwarded, so
# this cannot be spoofed
proxy_set_header X-Go2rtc-Stream-Proxy $go2rtc_stream_proxy;
proxy_set_header X-Server-Port $server_port;
proxy_set_header Content-Length "";
# Pass along auth related info
docker/main/rootfs/usr/local/nginx/conf/nginx.conf
+6
View File
@@ -202,6 +202,8 @@ http {
# frigate lovelace card uses this path
location /live/mse/api/ws {
# tells /auth to apply the go2rtc stream checks
set $go2rtc_stream_proxy 1;
include auth_request.conf;
limit_except GET {
deny all;
@@ -211,6 +213,8 @@ http {
}
location /live/webrtc/api/ws {
# tells /auth to apply the go2rtc stream checks
set $go2rtc_stream_proxy 1;
include auth_request.conf;
limit_except GET {
deny all;
@@ -231,6 +235,8 @@ http {
# integration uses this to add webrtc candidate
location /api/go2rtc/webrtc {
# tells /auth to apply the go2rtc stream checks
set $go2rtc_stream_proxy 1;
include auth_request.conf;
limit_except POST {
deny all;