Repository navigation
Backport(v1.19): in_http: add <auth> for basic authentication and <security> for client allowlisting - #5503
Merged
Conversation
* Add <security> section to in_http for client network allowlisting in_http gave operators no way to restrict who may post to it: the only options were binding to localhost, mTLS via <transport tls>, or putting a reverse proxy in front of fluentd. in_forward already has <security>, so mirror it here. - Add <security> with <client> network, enforced whenever one is given - Take an address or a CIDR range, IPv4 or IPv6 - Reject unlisted peers in on_server_connect, before reading any byte - Match the socket peer address, never X-Forwarded-For, which a client sets - Register a no-op data callback before closing, as the server helper requires the connect callback to install one Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com> * Add HTTP basic authentication to in_http out_http can already send basic credentials through its <auth> section, but in_http had no way to check them, so two fluentd instances could not be connected over HTTP without fronting the input with a proxy. - Add <auth> mirroring out_http: method, username, password - Reject in on_headers_complete, so the body of a 401 is never buffered - Compare with OpenSSL.secure_compare and reset the header per request, so a keep-alive connection cannot reuse an earlier request's credential - Drop Authorization from @env so add_http_headers cannot log the credential - Exempt CORS preflight, which browsers never send Authorization on Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com> * in_http: fix warning message Co-authored-by: Kentaro Hayashi <hayashi@clear-code.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com> * test_in_http: fix URL Co-authored-by: Kentaro Hayashi <hayashi@clear-code.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com> * test_in_http: fix URL Co-authored-by: Kentaro Hayashi <hayashi@clear-code.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com> --------- Signed-off-by: Shizuo Fujita <fujita@clear-code.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Kentaro Hayashi <hayashi@clear-code.com>
kenhys
approved these changes
Sep 28, 2026
kenhys
pushed a commit
to fluent/fluentd-docs-gitbook
that referenced
this pull request
Sep 29, 2026
fluentd 1.19.4 added two sections to in_http so that it no longer has to accept requests from anyone (fluent/fluentd#5503). <auth> requires basic authentication, and <security> limits which client addresses may connect. Signed-off-by: Shizuo Fujita <fujita@clear-code.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue(s) this PR fixes:
Fixes #3193
What this PR does / why we need it:
in_httpgives operators no way to restrict who may post to it. The only options today are binding to localhost, mTLS via<transport tls>, or fronting fluentd with a reverse proxy.out_httphas offered<auth>since long ago, so two fluentd instances still cannot be connected over HTTP without a proxy in between.Docs Changes:
fluent/fluentd-docs-gitbook#700
Release Note:
<auth>for basic authentication and<security>for client network allowlisting