Refuse to send credentials to a remote host over plain HTTP

The simulator posts a password to /api/v1/auth/login and then puts the
returned token on every report through bearerTransport. Against an http://
destination both go on the wire in cleartext.

Reject plain HTTP before login, except for loopback: the default is
http://localhost:8080 and that is how the simulator is normally run, so a
blanket HTTPS requirement would break the tool for its actual use.

Author: omlahore

cmd/simulator/main.go

@@ -9,7 +9,9 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"sync"
@@ -34,6 +36,41 @@ type stats struct {
 	totalMS   atomic.Int64
 }
 
+// checkBaseURL rejects a destination that would put the password and the
+// session token on the wire in cleartext. Plain HTTP stays allowed for
+// loopback, which is the default and the only way the simulator is normally
+// run, but anything remote has to be HTTPS.
+func checkBaseURL(raw string) error {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return fmt.Errorf("invalid -url %q: %w", raw, err)
+	}
+	if u.Host == "" {
+		return fmt.Errorf("invalid -url %q: no host", raw)
+	}
+	switch u.Scheme {
+	case "https":
+		return nil
+	case "http":
+		if isLoopbackHost(u.Hostname()) {
+			return nil
+		}
+		return fmt.Errorf("-url %q sends the login password and the bearer token in cleartext; use https for a remote host", raw)
+	default:
+		return fmt.Errorf("invalid -url %q: scheme must be http or https", raw)
+	}
+}
+
+func isLoopbackHost(host string) bool {
+	if host == "localhost" {
+		return true
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return ip.IsLoopback()
+	}
+	return false
+}
+
 func main() {
 	baseURL := flag.String("url", "http://localhost:8080", "Server base URL")
 	numVehicles := flag.Int("vehicles", 10, "Number of simulated vehicles")
@@ -58,6 +95,10 @@ func main() {
 		defer cancel()
 	}
 
+	if err := checkBaseURL(*baseURL); err != nil {
+		log.Fatal(err)
+	}
+
 	if *email == "" || *password == "" {
 		log.Fatal("email and password are required: POST /api/v1/locations is authenticated, " +
 			"so pass -email/-password or set ADMIN_BOOTSTRAP_EMAIL and ADMIN_BOOTSTRAP_PASSWORD")

cmd/simulator/main_test.go

@@ -358,3 +358,31 @@ func TestBearerTransportSetsAuthorizationHeader(t *testing.T) {
 
 	assert.Equal(t, "Bearer tok-123", gotAuth)
 }
+
+func TestCheckBaseURL(t *testing.T) {
+	allowed := []string{
+		"http://localhost:8080",
+		"http://127.0.0.1:8080",
+		"http://[::1]:8080",
+		"https://example.org",
+		"https://example.org:8443/base",
+	}
+	for _, raw := range allowed {
+		if err := checkBaseURL(raw); err != nil {
+			t.Errorf("checkBaseURL(%q) = %v, want nil", raw, err)
+		}
+	}
+
+	rejected := []string{
+		"http://example.org",       // credentials in cleartext to a remote host
+		"http://192.168.1.10:8080", // private, still not loopback
+		"ftp://example.org",        // not an HTTP scheme
+		"https://",                 // no host
+		"://nonsense",              // unparseable
+	}
+	for _, raw := range rejected {
+		if err := checkBaseURL(raw); err == nil {
+			t.Errorf("checkBaseURL(%q) = nil, want an error", raw)
+		}
+	}
+}