// The hard-coded default `DefaultAdminListen` can be overridden

// by setting the `CADDY_ADMIN` environment variable.

// The environment variable may be used by packagers to change

// the default admin address to something more appropriate for

// that platform. See #5317 for discussion.

if env, exists := os.LookupEnv("CADDY_ADMIN"); exists {

DefaultAdminListen = env

}

// If true, the admin endpoint will be completely disabled.

// Note that this makes any runtime changes to the config

// impossible, since the interface to do so is through the

// admin endpoint.

Disabled bool `json:"disabled,omitempty"`

// The address to which the admin endpoint's listener should

// bind itself. Can be any single network address that can be

// parsed by Caddy. Accepts placeholders.

// Default: the value of the `CADDY_ADMIN` environment variable,

// or `localhost:2019` otherwise.

//

// Remember: When changing this value through a config reload,

// be sure to use the `--address` CLI flag to specify the current

// admin address if the currently-running admin endpoint is not

// the default address.

Listen string `json:"listen,omitempty"`

// If true, CORS headers will be emitted, and requests to the

// API will be rejected if their `Host` and `Origin` headers

// do not match the expected value(s). Use `origins` to

// customize which origins/hosts are allowed. If `origins` is

// not set, the listen address is the only value allowed by

// default. Enforced only on local (plaintext) endpoint.

EnforceOrigin bool `json:"enforce_origin,omitempty"`

// The list of allowed origins/hosts for API requests. Only needed

// if accessing the admin endpoint from a host different from the

// socket's network interface or if `enforce_origin` is true. If not

// set, the listener address will be the default value. If set but

// empty, no origins will be allowed. Enforced only on local

// (plaintext) endpoint.

Origins []string `json:"origins,omitempty"`

// Options pertaining to configuration management.

Config *ConfigSettings `json:"config,omitempty"`

// Options that establish this server's identity. Identity refers to

// credentials which can be used to uniquely identify and authenticate

// this server instance. This is required if remote administration is

// enabled (but does not require remote administration to be enabled).

// Default: no identity management.

Identity *IdentityConfig `json:"identity,omitempty"`

// Options pertaining to remote administration. By default, remote

// administration is disabled. If enabled, identity management must

// also be configured, as that is how the endpoint is secured.

// See the neighboring "identity" object.

//

// EXPERIMENTAL: This feature is subject to change.

Remote *RemoteAdmin `json:"remote,omitempty"`

// Holds onto the routers so that we can later provision them

// if they require provisioning.

routers []AdminRouter

// Whether to keep a copy of the active config on disk. Default is true.

// Note that "pulled" dynamic configs (using the neighboring "load" module)

// are not persisted; only configs that are pushed to Caddy get persisted.

Persist *bool `json:"persist,omitempty"`

// Loads a new configuration. This is helpful if your configs are

// managed elsewhere and you want Caddy to pull its config dynamically

// when it starts. The pulled config completely replaces the current

// one, just like any other config load. It is an error if a pulled

// config is configured to pull another config without a load_delay,

// as this creates a tight loop.

//

// EXPERIMENTAL: Subject to change.

LoadRaw json.RawMessage `json:"load,omitempty" caddy:"namespace=caddy.config_loaders inline_key=module"`

// The duration after which to load config. If set, config will be pulled

// from the config loader after this duration. A delay is required if a

// dynamically-loaded config is configured to load yet another config. To

// load configs on a regular interval, ensure this value is set the same

// on all loaded configs; it can also be variable if needed, and to stop

// the loop, simply remove dynamic config loading from the next-loaded

// config.

//

// EXPERIMENTAL: Subject to change.

LoadDelay Duration `json:"load_delay,omitempty"`

// List of names or IP addresses which refer to this server.

// Certificates will be obtained for these identifiers so

// secure TLS connections can be made using them.

Identifiers []string `json:"identifiers,omitempty"`

// Issuers that can provide this admin endpoint its identity

// certificate(s). Default: ACME issuers configured for

// ZeroSSL and Let's Encrypt. Be sure to change this if you

// require credentials for private identifiers.

IssuersRaw []json.RawMessage `json:"issuers,omitempty" caddy:"namespace=tls.issuance inline_key=module"`

issuers []certmagic.Issuer

// The address on which to start the secure listener. Accepts placeholders.

// Default: :2021

Listen string `json:"listen,omitempty"`

// List of access controls for this secure admin endpoint.

// This configures TLS mutual authentication (i.e. authorized

// client certificates), but also application-layer permissions

// like which paths and methods each identity is authorized for.

AccessControl []*AdminAccess `json:"access_control,omitempty"`

// Base64-encoded DER certificates containing public keys to accept.

// (The contents of PEM certificate blocks are base64-encoded DER.)

// Any of these public keys can appear in any part of a verified chain.

PublicKeys []string `json:"public_keys,omitempty"`

// Limits what the associated identities are allowed to do.

// If unspecified, all permissions are granted.

Permissions []AdminPermissions `json:"permissions,omitempty"`

publicKeys []crypto.PublicKey

// The API paths allowed. Paths are simple prefix matches.

// Any subpath of the specified paths will be allowed.

Paths []string `json:"paths,omitempty"`

// The HTTP methods allowed for the given paths.

Methods []string `json:"methods,omitempty"`

muxWrap := adminHandler{mux: http.NewServeMux()}

// secure the local or remote endpoint respectively

if remote {

muxWrap.remoteControl = admin.Remote

} else {

muxWrap.enforceHost = !addr.isWildcardInterface()

muxWrap.allowedOrigins = admin.allowedOrigins(addr)

muxWrap.enforceOrigin = admin.EnforceOrigin

}

addRouteWithMetrics := func(pattern string, handlerLabel string, h http.Handler) {

labels := prometheus.Labels{"path": pattern, "handler": handlerLabel}

h = instrumentHandlerCounter(

adminMetrics.requestCount.MustCurryWith(labels),

h,

)

muxWrap.mux.Handle(pattern, h)

}

// addRoute just calls muxWrap.mux.Handle after

// wrapping the handler with error handling

addRoute := func(pattern string, handlerLabel string, h AdminHandler) {

wrapper := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

err := h.ServeHTTP(w, r)

if err != nil {

labels := prometheus.Labels{

"path": pattern,

"handler": handlerLabel,

"method": strings.ToUpper(r.Method),

}

adminMetrics.requestErrors.With(labels).Inc()

}

muxWrap.handleError(w, r, err)

})

addRouteWithMetrics(pattern, handlerLabel, wrapper)

}

const handlerLabel = "admin"

// register standard config control endpoints

addRoute("/"+rawConfigKey+"/", handlerLabel, AdminHandlerFunc(handleConfig))

addRoute("/id/", handlerLabel, AdminHandlerFunc(handleConfigID))

addRoute("/stop", handlerLabel, AdminHandlerFunc(handleStop))

// register debugging endpoints

addRouteWithMetrics("/debug/pprof/", handlerLabel, http.HandlerFunc(pprof.Index))

addRouteWithMetrics("/debug/pprof/cmdline", handlerLabel, http.HandlerFunc(pprof.Cmdline))

addRouteWithMetrics("/debug/pprof/profile", handlerLabel, http.HandlerFunc(pprof.Profile))

addRouteWithMetrics("/debug/pprof/symbol", handlerLabel, http.HandlerFunc(pprof.Symbol))

addRouteWithMetrics("/debug/pprof/trace", handlerLabel, http.HandlerFunc(pprof.Trace))

addRouteWithMetrics("/debug/vars", handlerLabel, expvar.Handler())

// register third-party module endpoints

for _, m := range GetModules("admin.api") {

router := m.New().(AdminRouter)

handlerLabel := m.ID.Name()

for _, route := range router.Routes() {

addRoute(route.Pattern, handlerLabel, route.Handler)

}

admin.routers = append(admin.routers, router)

}

return muxWrap

for _, router := range admin.routers {

provisioner, ok := router.(Provisioner)

if !ok {

continue

}

err := provisioner.Provision(ctx)

if err != nil {

return err

}

}

// We no longer need the routers once provisioned, allow for GC

admin.routers = nil

return nil

uniqueOrigins := make(map[string]struct{})

for _, o := range admin.Origins {

uniqueOrigins[o] = struct{}{}

}

if admin.Origins == nil {

if addr.isLoopback() {

if addr.IsUnixNetwork() {

// RFC 2616, Section 14.26:

// "A client MUST include a Host header field in all HTTP/1.1 request

// messages. If the requested URI does not include an Internet host

// name for the service being requested, then the Host header field MUST

// be given with an empty value."

//

// UPDATE July 2023: Go broke this by patching a minor security bug in 1.20.6.

// Understandable, but frustrating. See:

// https://github.com/golang/go/issues/60374

// See also the discussion here:

// https://github.com/golang/go/issues/61431

//

// We can no longer conform to RFC 2616 Section 14.26 from either Go or curl

// in purity. (Curl allowed no host between 7.40 and 7.50, but now requires a

// bogus host; see https://superuser.com/a/925610.) If we disable Host/Origin

// security checks, the infosec community assures me that it is secure to do

// so, because:

// 1) Browsers do not allow access to unix sockets

// 2) DNS is irrelevant to unix sockets

//

// I am not quite ready to trust either of those external factors, so instead

// of disabling Host/Origin checks, we now allow specific Host values when

// accessing the admin endpoint over unix sockets. I definitely don't trust

// DNS (e.g. I don't trust 'localhost' to always resolve to the local host),

// and IP shouldn't even be used, but if it is for some reason, I think we can

// at least be reasonably assured that 127.0.0.1 and ::1 route to the local

// machine, meaning that a hypothetical browser origin would have to be on the

// local machine as well.

uniqueOrigins[""] = struct{}{}

uniqueOrigins["127.0.0.1"] = struct{}{}

uniqueOrigins["::1"] = struct{}{}

} else {

uniqueOrigins[net.JoinHostPort("localhost", addr.port())] = struct{}{}

uniqueOrigins[net.JoinHostPort("::1", addr.port())] = struct{}{}

uniqueOrigins[net.JoinHostPort("127.0.0.1", addr.port())] = struct{}{}

}

}

if !addr.IsUnixNetwork() {

uniqueOrigins[addr.JoinHostPort(0)] = struct{}{}

}

}

allowed := make([]*url.URL, 0, len(uniqueOrigins))

for originStr := range uniqueOrigins {

var origin *url.URL

if strings.Contains(originStr, "://") {

var err error

origin, err = url.Parse(originStr)

if err != nil {

continue

}

origin.Path = ""

origin.RawPath = ""

origin.Fragment = ""

origin.RawFragment = ""

origin.RawQuery = ""

} else {

origin = &url.URL{Host: originStr}

}

allowed = append(allowed, origin)

}

return allowed

// always* be sure to close down the old admin endpoint

// as gracefully as possible, even if the new one is

// disabled -- careful to use reference to the current

// (old) admin endpoint since it will be different

// when the function returns

// (* except if the new one fails to start)

oldAdminServer := localAdminServer

var err error

defer func() {

// do the shutdown asynchronously so that any

// current API request gets a response; this

// goroutine may last a few seconds

if oldAdminServer != nil && err == nil {

go func(oldAdminServer *http.Server) {

err := stopAdminServer(oldAdminServer)

if err != nil {

Log().Named("admin").Error("stopping current admin endpoint", zap.Error(err))

}

}(oldAdminServer)

}

}()

// set a default if admin wasn't otherwise configured

if cfg.Admin == nil {

cfg.Admin = &AdminConfig{

Listen: DefaultAdminListen,

}

}

// if new admin endpoint is to be disabled, we're done

if cfg.Admin.Disabled {

Log().Named("admin").Warn("admin endpoint disabled")

return nil

}

// extract a singular listener address

addr, err := parseAdminListenAddr(cfg.Admin.Listen, DefaultAdminListen)

if err != nil {

return err

}

handler := cfg.Admin.newAdminHandler(addr, false)

ln, err := addr.Listen(context.TODO(), 0, net.ListenConfig{})

if err != nil {

return err

}

serverMu.Lock()

localAdminServer = &http.Server{

Addr: addr.String(), // for logging purposes only

Handler: handler,

ReadTimeout: 10 * time.Second,

ReadHeaderTimeout: 5 * time.Second,

IdleTimeout: 60 * time.Second,

MaxHeaderBytes: 1024 * 64,

}

serverMu.Unlock()

adminLogger := Log().Named("admin")

go func() {

serverMu.Lock()

server := localAdminServer

serverMu.Unlock()

if err := server.Serve(ln.(net.Listener)); !errors.Is(err, http.ErrServerClosed) {

adminLogger.Error("admin server shutdown for unknown reason", zap.Error(err))

}

}()

adminLogger.Info("admin endpoint started",

zap.String("address", addr.String()),

zap.Bool("enforce_origin", cfg.Admin.EnforceOrigin),

zap.Array("origins", loggableURLArray(handler.allowedOrigins)))

if !handler.enforceHost {

adminLogger.Warn("admin endpoint on open interface; host checking disabled",

zap.String("address", addr.String()))

}

return nil

if cfg == nil || cfg.Admin == nil || cfg.Admin.Identity == nil {

return nil

}

// set default issuers; this is pretty hacky because we can't

// import the caddytls package -- but it works

if cfg.Admin.Identity.IssuersRaw == nil {

cfg.Admin.Identity.IssuersRaw = []json.RawMessage{

json.RawMessage(`{"module": "acme"}`),

}

}

// load and provision issuer modules

if cfg.Admin.Identity.IssuersRaw != nil {

val, err := ctx.LoadModule(cfg.Admin.Identity, "IssuersRaw")

if err != nil {

return fmt.Errorf("loading identity issuer modules: %s", err)

}

for _, issVal := range val.([]any) {

cfg.Admin.Identity.issuers = append(cfg.Admin.Identity.issuers, issVal.(certmagic.Issuer))

}

}

// we'll make a new cache when we make the CertMagic config, so stop any previous cache

if identityCertCache != nil {

identityCertCache.Stop()

}

logger := Log().Named("admin.identity")

cmCfg := cfg.Admin.Identity.certmagicConfig(logger, true)

// issuers have circular dependencies with the configs because,

// as explained in the caddytls package, they need access to the

// correct storage and cache to solve ACME challenges

for _, issuer := range cfg.Admin.Identity.issuers {

// avoid import cycle with caddytls package, so manually duplicate the interface here, yuck

if annoying, ok := issuer.(interface{ SetConfig(cfg *certmagic.Config) }); ok {

annoying.SetConfig(cmCfg)

}

}

// obtain and renew server identity certificate(s)

return cmCfg.ManageAsync(ctx, cfg.Admin.Identity.Identifiers)

if cfg == nil {

return nil

}

remoteLogger := Log().Named("admin.remote")

oldAdminServer := remoteAdminServer

defer func() {

if oldAdminServer != nil {

go func(oldAdminServer *http.Server) {

err := stopAdminServer(oldAdminServer)

if err != nil {

Log().Named("admin").Error("stopping current secure admin endpoint", zap.Error(err))

}

}(oldAdminServer)

}

}()

if cfg.Admin == nil || cfg.Admin.Remote == nil {

return nil

}

addr, err := parseAdminListenAddr(cfg.Admin.Remote.Listen, DefaultRemoteAdminListen)

if err != nil {

return err

}

// make the HTTP handler but disable Host/Origin enforcement

// because we are using TLS authentication instead

handler := cfg.Admin.newAdminHandler(addr, true)

// create client certificate pool for TLS mutual auth, and extract public keys

// so that we can enforce access controls at the application layer

clientCertPool := x509.NewCertPool()

for i, accessControl := range cfg.Admin.Remote.AccessControl {

for j, certBase64 := range accessControl.PublicKeys {

cert, err := decodeBase64DERCert(certBase64)

if err != nil {

return fmt.Errorf("access control %d public key %d: parsing base64 certificate DER: %v", i, j, err)

}

accessControl.publicKeys = append(accessControl.publicKeys, cert.PublicKey)

clientCertPool.AddCert(cert)

}

}

// create TLS config that will enforce mutual authentication

if identityCertCache == nil {

return fmt.Errorf("cannot enable remote admin without a certificate cache; configure identity management to initialize a certificate cache")

}

cmCfg := cfg.Admin.Identity.certmagicConfig(remoteLogger, false)

tlsConfig := cmCfg.TLSConfig()

tlsConfig.NextProtos = nil // this server does not solve ACME challenges

tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert

tlsConfig.ClientCAs = clientCertPool

// convert logger to stdlib so it can be used by HTTP server

serverLogger, err := zap.NewStdLogAt(remoteLogger, zap.DebugLevel)

if err != nil {

return err

}

serverMu.Lock()

// create secure HTTP server

remoteAdminServer = &http.Server{

Addr: addr.String(), // for logging purposes only

Handler: handler,

TLSConfig: tlsConfig,

ReadTimeout: 10 * time.Second,

ReadHeaderTimeout: 5 * time.Second,

IdleTimeout: 60 * time.Second,

MaxHeaderBytes: 1024 * 64,

ErrorLog: serverLogger,

}

serverMu.Unlock()

// start listener

lnAny, err := addr.Listen(ctx, 0, net.ListenConfig{})

if err != nil {

return err

}

ln := lnAny.(net.Listener)

ln = tls.NewListener(ln, tlsConfig)

go func() {

serverMu.Lock()

server := remoteAdminServer

serverMu.Unlock()

if err := server.Serve(ln); !errors.Is(err, http.ErrServerClosed) {

remoteLogger.Error("admin remote server shutdown for unknown reason", zap.Error(err))

}

}()

remoteLogger.Info("secure admin remote control endpoint started",

zap.String("address", addr.String()))

return nil

var cmCfg *certmagic.Config

if ident == nil {

// user might not have configured identity; that's OK, we can still make a

// certmagic config, although it'll be mostly useless for remote management

ident = new(IdentityConfig)

}

template := certmagic.Config{

Storage: DefaultStorage, // do not act as part of a cluster (this is for the server's local identity)

Logger: logger,

Issuers: ident.issuers,

}

if makeCache {

identityCertCache = certmagic.NewCache(certmagic.CacheOptions{

GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {

return cmCfg, nil

},

Logger: logger.Named("cache"),

})

}

cmCfg = certmagic.New(identityCertCache, template)

return cmCfg

if ctx.cfg == nil || ctx.cfg.Admin == nil || ctx.cfg.Admin.Identity == nil {

return nil, fmt.Errorf("no server identity configured")

}

ident := ctx.cfg.Admin.Identity

if len(ident.Identifiers) == 0 {

return nil, fmt.Errorf("no identifiers configured")

}

if logger == nil {

logger = Log()

}

magic := ident.certmagicConfig(logger, false)

return magic.ClientCredentials(ctx, ident.Identifiers)

for _, chain := range r.TLS.VerifiedChains {

for _, peerCert := range chain {

for _, adminAccess := range remote.AccessControl {

for _, allowedKey := range adminAccess.publicKeys {

// see if we found a matching public key; the TLS server already verified the chain

// so we know the client possesses the associated private key; this handy interface

// doesn't appear to be defined anywhere in the std lib, but was implemented here:

// https://github.com/golang/go/commit/b5f2c0f50297fa5cd14af668ddd7fd923626cf8c

comparer, ok := peerCert.PublicKey.(interface{ Equal(crypto.PublicKey) bool })

if !ok || !comparer.Equal(allowedKey) {

continue

}

// key recognized; make sure its HTTP request is permitted

for _, accessPerm := range adminAccess.Permissions {

// verify method

methodFound := accessPerm.Methods == nil

for _, method := range accessPerm.Methods {

if method == r.Method {

methodFound = true

break

}

}

if !methodFound {

return APIError{

HTTPStatus: http.StatusForbidden,

Message: "not authorized to use this method",

}

}

// verify path

pathFound := accessPerm.Paths == nil

for _, allowedPath := range accessPerm.Paths {

if strings.HasPrefix(r.URL.Path, allowedPath) {

pathFound = true

break

}

}

if !pathFound {

return APIError{

HTTPStatus: http.StatusForbidden,

Message: "not authorized to access this path",

}

}

}

// public key authorized, method and path allowed

return nil

}

}

}

}

// in theory, this should never happen; with an unverified chain, the TLS server

// should not accept the connection in the first place, and the acceptable cert

// pool is configured using the same list of public keys we verify against

return APIError{

HTTPStatus: http.StatusUnauthorized,

Message: "client identity not authorized",

}

if srv == nil {

return fmt.Errorf("no admin server")

}

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)

defer cancel()

err := srv.Shutdown(ctx)

if err != nil {

return fmt.Errorf("shutting down admin server: %v", err)

}

Log().Named("admin").Info("stopped previous server", zap.String("address", srv.Addr))

return nil

mux *http.ServeMux

// security for local/plaintext endpoint

enforceOrigin bool

enforceHost bool

allowedOrigins []*url.URL

// security for remote/encrypted endpoint

remoteControl *RemoteAdmin

ip, port, err := net.SplitHostPort(r.RemoteAddr)

if err != nil {

ip = r.RemoteAddr

port = ""

}

log := Log().Named("admin.api").With(

zap.String("method", r.Method),

zap.String("host", r.Host),

zap.String("uri", r.RequestURI),

zap.String("remote_ip", ip),

zap.String("remote_port", port),

zap.Reflect("headers", r.Header),

)

if r.TLS != nil {

log = log.With(

zap.Bool("secure", true),

zap.Int("verified_chains", len(r.TLS.VerifiedChains)),

)

}

if r.RequestURI == "/metrics" {

log.Debug("received request")

} else {

log.Info("received request")

}

h.serveHTTP(w, r)

if h.remoteControl != nil {

// enforce access controls on secure endpoint

if err := h.remoteControl.enforceAccessControls(r); err != nil {

h.handleError(w, r, err)

return

}

}

if strings.Contains(r.Header.Get("Upgrade"), "websocket") {

// I've never been able demonstrate a vulnerability myself, but apparently

// WebSocket connections originating from browsers aren't subject to CORS

// restrictions, so we'll just be on the safe side

h.handleError(w, r, fmt.Errorf("websocket connections aren't allowed"))

return

}

if h.enforceHost {

// DNS rebinding mitigation

err := h.checkHost(r)

if err != nil {

h.handleError(w, r, err)

return

}

}

if h.enforceOrigin {

// cross-site mitigation

origin, err := h.checkOrigin(r)

if err != nil {

h.handleError(w, r, err)

return

}

if r.Method == http.MethodOptions {

w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, DELETE")

w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Cache-Control")

w.Header().Set("Access-Control-Allow-Credentials", "true")

}

w.Header().Set("Access-Control-Allow-Origin", origin)

}

h.mux.ServeHTTP(w, r)

if err == nil {

return

}

if err == errInternalRedir {

h.serveHTTP(w, r)

return

}

apiErr, ok := err.(APIError)

if !ok {

apiErr = APIError{

HTTPStatus: http.StatusInternalServerError,

Err: err,

}

}

if apiErr.HTTPStatus == 0 {

apiErr.HTTPStatus = http.StatusInternalServerError

}

if apiErr.Message == "" && apiErr.Err != nil {

apiErr.Message = apiErr.Err.Error()

}

Log().Named("admin.api").Error("request error",

zap.Error(err),

zap.Int("status_code", apiErr.HTTPStatus),

)

w.Header().Set("Content-Type", "application/json")

w.WriteHeader(apiErr.HTTPStatus)

encErr := json.NewEncoder(w).Encode(apiErr)

if encErr != nil {

Log().Named("admin.api").Error("failed to encode error response", zap.Error(encErr))

}

var allowed bool

for _, allowedOrigin := range h.allowedOrigins {

if r.Host == allowedOrigin.Host {

allowed = true

break

}

}

if !allowed {

return APIError{

HTTPStatus: http.StatusForbidden,

Err: fmt.Errorf("host not allowed: %s", r.Host),

}

}

return nil

originStr, origin := h.getOrigin(r)

if origin == nil {

return "", APIError{

HTTPStatus: http.StatusForbidden,

Err: fmt.Errorf("required Origin header is missing or invalid"),

}

}

if !h.originAllowed(origin) {

return "", APIError{

HTTPStatus: http.StatusForbidden,

Err: fmt.Errorf("client is not allowed to access from origin '%s'", originStr),

}

}

return origin.String(), nil

origin := r.Header.Get("Origin")

if origin == "" {

origin = r.Header.Get("Referer")

}

originURL, err := url.Parse(origin)

if err != nil {

return origin, nil

}

originURL.Path = ""

originURL.RawPath = ""

originURL.Fragment = ""

originURL.RawFragment = ""

originURL.RawQuery = ""

return origin, originURL

for _, allowedOrigin := range h.allowedOrigins {

if allowedOrigin.Scheme != "" && origin.Scheme != allowedOrigin.Scheme {

continue

}

if origin.Host == allowedOrigin.Host {

return true

}

}

return false

switch r.Method {

case http.MethodGet:

w.Header().Set("Content-Type", "application/json")

hash := etagHasher()

// Read the config into a buffer instead of writing directly to

// the response writer, as we want to set the ETag as the header,

// not the trailer.

buf := bufferPool.Get().(*bytes.Buffer)

buf.Reset()

defer bufferPool.Put(buf)

configWriter := io.MultiWriter(buf, hash)

err := readConfig(r.URL.Path, configWriter)

if err != nil {

return APIError{HTTPStatus: http.StatusBadRequest, Err: err}

}

// we could consider setting up a sync.Pool for the summed

// hashes to reduce GC pressure.

w.Header().Set("Etag", makeEtag(r.URL.Path, hash))

_, err = w.Write(buf.Bytes())

if err != nil {

return APIError{HTTPStatus: http.StatusInternalServerError, Err: err}

}

return nil

case http.MethodPost,

http.MethodPut,

http.MethodPatch,

http.MethodDelete:

// DELETE does not use a body, but the others do

var body []byte

if r.Method != http.MethodDelete {