Support CDN-Loop header
- Dominant language
- C#
- Stars
- 9.6k
- Forks
- 933
- Avg merge
- 12d 18h
- Merged PRs (30d)
- 2
Description
[RFC8586](https://datatracker.ietf.org/doc/html/rfc8586) defines a header CDN-Loop which should be read and set by proxies to detect if they are being used in a loop. YARP should be able to add itself and detect if its already listed as a proxy in the request chain.
```
1. Introduction
In modern deployments of HTTP servers, it is common to interpose
Content Delivery Networks (CDNs) in front of origin servers to
improve latency perceived by end users, reduce operational costs, and
improve scalability and reliability of services.
Often, more than one CDN is in use by a given origin. This happens
for a variety of reasons, such as cost savings, arranging for
failover should one CDN have issues, or direct comparison of the
CDNs' services.
As a result, it is possible for forwarding CDNs to be configured in a
"loop" accidentally; because routing is achieved through a
combination of DNS and forwarding rules, and site configurations are
sometimes complex and managed by several parties.
When this happens, it is difficult to debug. Additionally, it
sometimes isn't accidental; loops between multiple CDNs can be used
as an attack vector (e.g., see [loop-attack]), especially if one CDN
unintentionally strips the loop detection headers of another.
This specification defines the CDN-Loop HTTP request header field to
help detect such attacks and accidents among forwarding CDNs that
have implemented it; the header field may not be modified by their
customers.
```
Contributor guide
Assessment
This issue has not been assessed yet.