feat(proxy): add privacy header mode

Author: hightemp

.env.example

@@ -16,6 +16,9 @@ PROXY_NETWORK=auto
 # DANGEROUS: temporarily log full URLs, upstream errors, and rejected credentials.
 PROXY_LOG_SENSITIVE_DATA=false
 
+# Best-effort HTTP header privacy. See README for HTTPS/WebRTC limitations.
+PROXY_PRIVACY_MODE=false
+
 # Resource limits.
 PROXY_MAX_CONNECTIONS=1024
 PROXY_MAX_CONNECTIONS_PER_IP=128

README.md

@@ -16,6 +16,7 @@ A secure HTTP/HTTPS proxy server in Go with Basic authentication, TLS support, a
 
 - HTTP and HTTPS proxy modes
 - HTTP/2 CONNECT multiplexing in HTTPS mode with HTTP/1.1 fallback
+- Optional privacy mode for stripping client-IP and proxy-chain headers
 - Basic authentication
 - TLS with configurable certificates
 - Upstream proxy chaining (proxy chain support)
@@ -75,6 +76,7 @@ Any of these override the corresponding YAML field:
 | `PROXY_UPSTREAM_PROXY` | `upstream_proxy` (URL or `direct`) |
 | `PROXY_NETWORK` | `network` (`auto` / `tcp4` / `tcp6`) |
 | `PROXY_LOG_SENSITIVE_DATA` | `log_sensitive_data` (`true` exposes full request URLs, upstream errors, and rejected credentials in logs) |
+| `PROXY_PRIVACY_MODE` | `privacy_mode` (best-effort HTTP header privacy) |
 | `PROXY_MAX_CONNECTIONS` | `max_connections` |
 | `PROXY_MAX_CONNECTIONS_PER_IP` | `max_connections_per_ip` |
 | `PROXY_MAX_TUNNELS` | `max_tunnels` |
@@ -166,6 +168,7 @@ cert_path: ""
 key_path: ""
 network: auto
 log_sensitive_data: false
+privacy_mode: false
 max_connections: 1024
 max_connections_per_ip: 128
 max_tunnels: 256
@@ -208,6 +211,7 @@ The example listens on localhost. Set `proxy_addr` to `0.0.0.0:8080` only when t
 | `upstream_proxy` | Upstream proxy URL, `direct`, or empty to use proxy environment variables |
 | `network` | Outbound address family: `auto`, `tcp4`, or `tcp6` |
 | `log_sensitive_data` | Log full request URLs, upstream errors, and rejected Basic Auth username/password; disabled by default |
+| `privacy_mode` | Strip client-IP/forwarding headers and suppress `Via` for proxy-visible HTTP metadata |
 | `max_connections` | Maximum simultaneous client TCP connections |
 | `max_connections_per_ip` | Maximum simultaneous client connections per source IP |
 | `max_tunnels` | Maximum simultaneous CONNECT tunnels |
@@ -238,6 +242,12 @@ Timeout values use Go duration syntax, for example `500ms`, `10s`, or `2m`. Unkn
 
 By default, request URL userinfo and query parameters are removed from logs, upstream errors are reduced to their HTTP category, and rejected Basic Auth credentials are not logged. For temporary diagnostics, set `log_sensitive_data: true` or `PROXY_LOG_SENSITIVE_DATA=true`. This can expose passwords and tokens in plaintext logs; disable it immediately after debugging.
 
+### Privacy mode
+
+Set `privacy_mode: true` or `PROXY_PRIVACY_MODE=true` to remove known client-address forwarding metadata from ordinary HTTP requests and trailers, including RFC `Forwarded`, `Via`, `X-Forwarded-*`, `X-Real-IP`, `True-Client-IP`, CDN connecting-IP headers, and common vendor equivalents. The proxy also omits its own `Via` header and does not forward a `Via` chain to an upstream proxy.
+
+This is best-effort header privacy, not full anonymity. HTTPS/WSS traffic inside CONNECT is encrypted end-to-end, so the proxy cannot remove cookies, authorization headers, browser fingerprints, or application identifiers without acting as a TLS interception proxy. Browser traffic outside HTTP/HTTPS/WS/WSS, including WebRTC or other UDP paths, can bypass a web proxy. Sites can also classify the server's public IP as hosting, VPN, or proxy infrastructure.
+
 ### Resource limits and destination policy
 
 Connection and CONNECT limits are enforced globally and per source IP. Excess TCP connections are closed immediately; excess tunnels and rate-limited authentication attempts receive `429 Too Many Requests`. A tunnel is closed when no bytes flow in either direction for `tunnel_idle_timeout`. Unless explicitly overridden, the HTTP/2 SETTINGS stream limit is derived from the lower tunnel limit so clients do not open streams that the proxy would immediately reject.

VERSION

@@ -1 +1 @@
-0.5.1
+0.6.0

config.docker.yaml

@@ -6,6 +6,7 @@ cert_path: ""
 key_path: ""
 network: auto
 log_sensitive_data: false
+privacy_mode: false
 max_connections: 1024
 max_connections_per_ip: 128
 max_tunnels: 256

config.example.yaml

@@ -6,6 +6,7 @@ cert_path: ./cert.pem
 key_path: ./key.pem
 network: auto
 log_sensitive_data: false
+privacy_mode: false
 max_connections: 1024
 max_connections_per_ip: 128
 max_tunnels: 256

docker-compose.yml

@@ -14,6 +14,7 @@ services:
       PROXY_UPSTREAM_PROXY: ${PROXY_UPSTREAM_PROXY:-}
       PROXY_NETWORK: ${PROXY_NETWORK:-auto}
       PROXY_LOG_SENSITIVE_DATA: "${PROXY_LOG_SENSITIVE_DATA:-false}"
+      PROXY_PRIVACY_MODE: "${PROXY_PRIVACY_MODE:-false}"
       PROXY_MAX_CONNECTIONS: "${PROXY_MAX_CONNECTIONS:-1024}"
       PROXY_MAX_CONNECTIONS_PER_IP: "${PROXY_MAX_CONNECTIONS_PER_IP:-128}"
       PROXY_MAX_TUNNELS: "${PROXY_MAX_TUNNELS:-256}"
@@ -50,6 +51,7 @@ services:
       PROXY_UPSTREAM_PROXY: ${PROXY_UPSTREAM_PROXY:-}
       PROXY_NETWORK: ${PROXY_NETWORK:-auto}
       PROXY_LOG_SENSITIVE_DATA: "${PROXY_LOG_SENSITIVE_DATA:-false}"
+      PROXY_PRIVACY_MODE: "${PROXY_PRIVACY_MODE:-false}"
       PROXY_MAX_CONNECTIONS: "${PROXY_MAX_CONNECTIONS:-1024}"
       PROXY_MAX_CONNECTIONS_PER_IP: "${PROXY_MAX_CONNECTIONS_PER_IP:-128}"
       PROXY_MAX_TUNNELS: "${PROXY_MAX_TUNNELS:-256}"

internal/config/config.go

@@ -50,6 +50,7 @@ type Config struct {
 	UpstreamProxy             string   `yaml:"upstream_proxy"`
 	Network                   string   `yaml:"network"`
 	LogSensitiveData          bool     `yaml:"log_sensitive_data"`
+	PrivacyMode               bool     `yaml:"privacy_mode"`
 	MaxConnections            int      `yaml:"max_connections"`
 	MaxConnectionsPerIP       int      `yaml:"max_connections_per_ip"`
 	MaxTunnels                int      `yaml:"max_tunnels"`
@@ -87,6 +88,7 @@ func defaultConfig() Config {
 		ProxyAddr:                 "127.0.0.1:8080",
 		Proto:                     "http",
 		Network:                   "auto",
+		PrivacyMode:               false,
 		MaxConnections:            1024,
 		MaxConnectionsPerIP:       128,
 		MaxTunnels:                256,
@@ -161,7 +163,8 @@ func decodeConfig(r io.Reader) (Config, error) {
 //
 //	PROXY_ADDR, PROXY_USERNAME, PROXY_PASSWORD, PROXY_PROTO,
 //	PROXY_CERT_PATH, PROXY_KEY_PATH, PROXY_UPSTREAM_PROXY, PROXY_NETWORK,
-//	PROXY_LOG_SENSITIVE_DATA, PROXY_MAX_CONNECTIONS,
+//	PROXY_LOG_SENSITIVE_DATA, PROXY_PRIVACY_MODE,
+//	PROXY_MAX_CONNECTIONS,
 //	PROXY_MAX_CONNECTIONS_PER_IP, PROXY_MAX_TUNNELS,
 //	PROXY_MAX_TUNNELS_PER_IP, PROXY_HTTP2_MAX_CONCURRENT_STREAMS,
 //	PROXY_MAX_IDLE_CONNS,
@@ -207,6 +210,7 @@ func applyEnvOverrides(c *Config) error {
 		dest *bool
 	}{
 		{"PROXY_LOG_SENSITIVE_DATA", &c.LogSensitiveData},
+		{"PROXY_PRIVACY_MODE", &c.PrivacyMode},
 		{"PROXY_ALLOW_PRIVATE_DESTINATIONS", &c.AllowPrivateDestinations},
 	}
 	for _, override := range boolOverrides {

internal/config/config_test.go

@@ -60,6 +60,7 @@ func TestDecodeConfig(t *testing.T) {
 				"proxy_addr: 0.0.0.0:3128",
 				"network: tcp4",
 				"log_sensitive_data: true",
+				"privacy_mode: true",
 				"max_connections: 200",
 				"max_connections_per_ip: 20",
 				"max_tunnels: 50",
@@ -97,6 +98,9 @@ func TestDecodeConfig(t *testing.T) {
 				if !got.LogSensitiveData {
 					t.Error("LogSensitiveData = false, want true")
 				}
+				if !got.PrivacyMode {
+					t.Error("PrivacyMode = false, want true")
+				}
 				if !got.AllowPrivateDestinations {
 					t.Error("AllowPrivateDestinations = false, want true")
 				}
@@ -681,6 +685,42 @@ func TestApplyEnvOverridesParsesLogSensitiveData(t *testing.T) {
 	}
 }
 
+func TestApplyEnvOverridesParsesPrivacyMode(t *testing.T) {
+	tests := []struct {
+		name      string
+		value     string
+		want      bool
+		wantError bool
+	}{
+		{name: "enabled", value: "true", want: true},
+		{name: "disabled", value: "false", want: false},
+		{name: "invalid", value: "sometimes", wantError: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			clearProxyEnvironment(t)
+			t.Setenv("PROXY_PRIVACY_MODE", test.value)
+			config := defaultConfig()
+			config.PrivacyMode = !test.want
+
+			err := applyEnvOverrides(&config)
+			if test.wantError {
+				if err == nil || !strings.Contains(err.Error(), "PROXY_PRIVACY_MODE") {
+					t.Fatalf("applyEnvOverrides() error = %v, want boolean parse error", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("applyEnvOverrides() error = %v", err)
+			}
+			if config.PrivacyMode != test.want {
+				t.Fatalf("PrivacyMode = %t, want %t", config.PrivacyMode, test.want)
+			}
+		})
+	}
+}
+
 func TestApplyEnvOverridesParsesResourceLimits(t *testing.T) {
 	clearProxyEnvironment(t)
 	for name, value := range map[string]string{
@@ -876,6 +916,7 @@ func clearProxyEnvironment(t *testing.T) {
 		"PROXY_UPSTREAM_PROXY",
 		"PROXY_NETWORK",
 		"PROXY_LOG_SENSITIVE_DATA",
+		"PROXY_PRIVACY_MODE",
 		"PROXY_MAX_CONNECTIONS",
 		"PROXY_MAX_CONNECTIONS_PER_IP",
 		"PROXY_MAX_TUNNELS",

internal/proxy/headers.go

@@ -2,13 +2,61 @@ package proxy
 
 import (
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 )
 
 // viaReceivedBy is a stable pseudonym, as permitted for the Via received-by value.
 const viaReceivedBy = "https_proxy"
 
+var privacyHeaderNames = map[string]struct{}{
+	"cf-connecting-ip":         {},
+	"client-ip":                {},
+	"do-connecting-ip":         {},
+	"fastly-client-ip":         {},
+	"fly-client-ip":            {},
+	"forwarded":                {},
+	"remote-addr":              {},
+	"true-client-ip":           {},
+	"via":                      {},
+	"x-appengine-user-ip":      {},
+	"x-azure-clientip":         {},
+	"x-client-ip":              {},
+	"x-cluster-client-ip":      {},
+	"x-envoy-external-address": {},
+	"x-forwarded":              {},
+	"x-originating-ip":         {},
+	"x-original-forwarded-for": {},
+	"x-proxyuser-ip":           {},
+	"x-real-ip":                {},
+	"x-remote-addr":            {},
+	"x-remote-ip":              {},
+}
+
+func removePrivacyHeaders(header http.Header) {
+	for name := range header {
+		normalized := strings.ToLower(name)
+		_, exactMatch := privacyHeaderNames[normalized]
+		if exactMatch || strings.HasPrefix(normalized, "x-forwarded-") {
+			delete(header, name)
+		}
+	}
+}
+
+type privacyTrailerBody struct {
+	io.ReadCloser
+	trailer http.Header
+}
+
+func (b *privacyTrailerBody) Read(buffer []byte) (int, error) {
+	read, err := b.ReadCloser.Read(buffer)
+	if err == io.EOF {
+		removePrivacyHeaders(b.trailer)
+	}
+	return read, err
+}
+
 func appendVia(header http.Header, protoMajor, protoMinor int) {
 	header.Add("Via", fmt.Sprintf("%d.%d %s", protoMajor, protoMinor, viaReceivedBy))
 }

internal/proxy/http2_connect_test.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sync"
@@ -141,6 +142,70 @@ func TestAuthenticatedHTTP2ConnectTunnel(t *testing.T) {
 	}
 }
 
+func TestHTTP2ForwardsPlainHTTPWithPrivacyMode(t *testing.T) {
+	originResult := make(chan error, 1)
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/privacy" || r.URL.RawQuery != "check=yes" {
+			originResult <- fmt.Errorf("origin URL = %s", r.URL.String())
+			return
+		}
+		for _, name := range []string{"Forwarded", "Via", "X-Forwarded-For", "X-Real-IP"} {
+			if value := r.Header.Get(name); value != "" {
+				originResult <- fmt.Errorf("origin %s = %q", name, value)
+				return
+			}
+		}
+		if value := r.Header.Get("X-Keep"); value != "keep-value" {
+			originResult <- fmt.Errorf("origin X-Keep = %q", value)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+		originResult <- nil
+	}))
+	t.Cleanup(origin.Close)
+	originURL, err := url.Parse(origin.URL)
+	if err != nil {
+		t.Fatalf("parse origin URL: %v", err)
+	}
+
+	cfg := config.Default()
+	cfg.AllowPrivateDestinations = true
+	cfg.BlockedDestinationPorts = nil
+	cfg.PrivacyMode = true
+	proxyHandler, err := NewServer(cfg)
+	if err != nil {
+		t.Fatalf("NewServer() error = %v", err)
+	}
+
+	var proxyConnections atomic.Int32
+	proxyTLS := newHTTP2TestServer(proxyHandler, &proxyConnections)
+	t.Cleanup(proxyTLS.Close)
+	client := proxyTLS.Client()
+	client.Timeout = testIOTimeout
+
+	request, err := http.NewRequest(http.MethodGet, proxyTLS.URL+"/privacy?check=yes", nil)
+	if err != nil {
+		t.Fatalf("create HTTP/2 proxy request: %v", err)
+	}
+	request.Host = originURL.Host
+	request.Header.Set("Forwarded", "for=192.0.2.40")
+	request.Header.Set("Via", "1.1 client-proxy")
+	request.Header.Set("X-Forwarded-For", "192.0.2.41")
+	request.Header.Set("X-Real-IP", "192.0.2.42")
+	request.Header.Set("X-Keep", "keep-value")
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatalf("perform HTTP/2 proxy request: %v", err)
+	}
+	defer func() { _ = response.Body.Close() }()
+	if response.ProtoMajor != 2 || response.StatusCode != http.StatusNoContent {
+		t.Fatalf("proxy response = %s %d, want HTTP/2 204", response.Proto, response.StatusCode)
+	}
+	if err := <-originResult; err != nil {
+		t.Fatalf("origin: %v", err)
+	}
+}
+
 func TestHTTP2ConnectMultiplexesMoreThanHTTP1ProxyLimit(t *testing.T) {
 	const tunnelCount = 40