How to send request from HTTPoison with proxy in docker

Uh, I don’t think nginx can work as a socks proxy, at least I’ve never tried? Why can’t it access straight out or through a tunnel, or reverse proxy recaptcha or so?

EDIT: Apparently there is a socks plugin for nginx, did you compile it in? It looks like it might be a bit out of date too…

i’m confused, if I don’t give internet to the elixir container, it can’t connect to google api. if I give it to the elixir container, may it have a security problem because it can’t be isolate? what is your suggestion, generally?

I don’t know why it does!!!

Well if it needs internet access then that needs to be supplied somehow. A single outgoing port and then binding to it for your outgoing connections (or a pool of them) seems perfectly sufficient since no incoming connections would be allowed? Or if you need an incoming connection too then a single port for that or whatever.

if I understood what you said, I should create a firewall rule to filter this container internet , shouldn’t I ? if your answer is okay, would you mind telling me how I can do this ? because I tried to create iptables rule to filter and limit to just Google Api, but I couldn’t !!

my docker network was linked by internal domain like: http://elixir_api or http://elixir_html, how can I filter its internet for example http://elixir_html, that it just send and receive from google not another domain

Thanks

Docker can do it all fine already, just expose the specific port you want to listen in for incoming connections (if any) and just let it communicate ‘out’ via a bridge network to the host.

Are you actually wanting to restrict it to specific domains only? A reverse proxy would be safer there.

Thanks, I set rule in iptables, but I couldn’t find anything about you told me, I can expose port from docker but I cant set up in nginx, how can I do? would you mind giving me a reference or tutorial?

Well what are the very specific requirements you are needing first?

Do you need incoming connections, outgoing connections, both? Do they need to be restricted to very specific sets of IP’s, domains, data, etc…? Etc…

I do not have much information, but I just need to filter my internet that it is forced to load google not another site or ip . I need incoming connections and outgoing connections, both, but just from google recaptcha api, I want my internet to be filtered to load , Only Google ip or api domain .

can I describe my need well?

That then begs the question, ‘what’ is making the remote API call, is it your own controlled code or some untrusted user code?

User send me a Recapcha code that google js file creates and then I send this code to the google api

the code sender:

  def google_post_recap(root_link, params) do
    body = "secret=#{params["secret"]}&response=#{params["response"]}"
    HTTPoison.post(
      "#{root_link}",
       body,
        [
          {"Content-Type", "application/x-www-form-urlencoded"},
          {"Accept", "text/html"}
        ],
       [timeout: 50_000, recv_timeout: 50_000]
    )
  end

and

  # login sender
  def login_register_sender(conn, %{"email" => _email, "password" => _password}  = info_of_login) do

    ip_os = TrangellHtmlSite.ip_os(conn)
    info_map = User.login_mapper(info_of_login)
    with {:ok, %HTTPoison.Response{status_code: 200, body: body_of_token}} <- TrangellHtmlSite.User.google_recap(info_of_login["g-recaptcha-response"]),
    %{"challenge_ts" => _time, "hostname" => _host, "success" => true} <- Jason.decode!(body_of_token),
    {:ok, %HTTPoison.Response{status_code: 200, body: _user_info}} <- User.login_sender(info_map, ip_os.ip, ip_os.os) do

      conn
      |> put_flash(:info, "کد فعال سازی دو مرحله ای برای شما ایمیل گردید لطفا به ایمیل خود مراجعه کرده و در فرم زیر کد مذکور به همراه ایمیل خود وارد کنید")
      |> redirect( to: "/verify-code")
    end
  end

  # google
  def google_recap(response) do
    TrangellHtmlSite.google_post_recap("https://www.google.com/recaptcha/api/siteverify", %{"secret" => "MY secret code", "response" => response}) 
    |> IO.inspect
  end

after those codes google send me a Json that I use like this

{:ok,
 %HTTPoison.Response{
   body: "{\n  \"success\": true,\n  \"challenge_ts\": \"2018-10-31T20:38:43Z\",\n  \"hostname\": \"localhost\"\n}",
   headers: [
     {"Content-Type", "application/json; charset=utf-8"},
     {"Date", "Wed, 31 Oct 2018 20:40:01 GMT"},
     {"Expires", "Wed, 31 Oct 2018 20:40:01 GMT"},
     {"Cache-Control", "private, max-age=0"},
     {"X-Content-Type-Options", "nosniff"},
     {"X-XSS-Protection", "1; mode=block"},
     {"Server", "GSE"},
     {"Alt-Svc", "quic=\":443\"; ma=2592000; v=\"44,43,39,35\""},
     {"Accept-Ranges", "none"},
     {"Vary", "Accept-Encoding"},
     {"Transfer-Encoding", "chunked"}
   ],
   request_url: "https://www.google.com/recaptcha/api/siteverify",
   status_code: 200
 }}

all of my code is that, I think that user sent code can be untrusted but google decides to verify or unverify