fix: handler HEAD calls in sse routes

[lucarin91]

Motivation

On SSE handlers, we need to make sure that we early return in HEAD calls, otherwise we remain attacked forever.

Change description

Additional Notes

Reviewer checklist

• PR addresses a single concern.
• PR title and description are properly filled.
• Changes will be merged in main.
• Changes are covered by tests.
• Logging is meaningful in case of troubleshooting.

[dido18]

I suggest using a reusable middleware

func headMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method == "HEAD" {
			w.WriteHeader(http.StatusOK)
			return
		}
		next.ServeHTTP(w, r)
	})
}

usage

	mux.Handle("GET /v1/apps/events", headMiddleware(handlers.HandlerAppStatus(dockerClient, idProvider, cfg)))

[lucarin91]

I suggest using a reusable middleware

func headMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method == "HEAD" {
			w.WriteHeader(http.StatusOK)
			return
		}
		next.ServeHTTP(w, r)
	})
}

usage

	mux.Handle("GET /v1/apps/events", headMiddleware(handlers.HandlerAppStatus(dockerClient, idProvider, cfg)))

I was thinking about that but I was also concern by the fact that I think the HEAD request should do the same parameter checks we are doing in the GET request and not always return 200 OK.

For instance, I would expect that

HEAD /v1/apps/<asd>/logs?tail=not-a-nuber

Will return an error because tail should be a number. In that sense the HEAD request is like a pre-fligth of the GET request. Anyway i didn't read explicit mansion of parameter validation in the HEAD semantics document here. They only say that the HEAD method should behave like the GET method without the body, which is a little bit left to the interpretation.

[dido18]

But why is the FE sending the HEAD request?

I suggest using a reusable middleware

func headMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method == "HEAD" {
			w.WriteHeader(http.StatusOK)
			return
		}
		next.ServeHTTP(w, r)
	})
}

usage

	mux.Handle("GET /v1/apps/events", headMiddleware(handlers.HandlerAppStatus(dockerClient, idProvider, cfg)))

I was thinking about that but I was also concern by the fact that I think the HEAD request should do the same parameter checks we are doing in the GET request and not always return 200 OK.

For instance, I would expect that

HEAD /v1/apps/<asd>/logs?tail=not-a-nuber

Will return an error because tail should be a number. In that sense the HEAD request is like a pre-fligth of the GET request. Anyway i didn't read explicit mansion of parameter validation in the HEAD semantics document here. They only say that the HEAD method should behave like the GET method without the body, which is a little bit left to the interpretation.

ok, it is strange that the FE is sending a HEAD to the SSE endpoint.
The standard definition mentions the fetch(GET) https://html.spec.whatwg.org/multipage/server-sent-events.html.

What clients is the FE using to call the SSE endpoint?