in internal/service/server.go [164:184]
func (s *Server) validateToken(r *http.Request) error {
if r.URL.Path == "/ping" {
return nil
}
if _, ok := r.Header["X-Forwarded-For"]; ok {
errors.New("forwarded")
}
if s.DisableSSRFToken {
return nil
}
for _, header := range s.ssrfHeaders {
if token := r.Header.Get(header); token == s.ssrfToken {
return nil
}
}
return errors.New("bad token")
}