From 38eed7cce6378846fb30a49845cd2ddc42dfa8ac Mon Sep 17 00:00:00 2001
From: Hampus <hampus@fluxer.app>
Date: Sat, 29 Aug 2026 14:54:56 +0200
Subject: [PATCH] fix(gateway): restrict /_metrics to loopback callers (#2072)

---
 .../src/gateway/metrics_handler.erl           | 38 +++++++++++++++----
 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/fluxer_gateway/src/gateway/metrics_handler.erl b/fluxer_gateway/src/gateway/metrics_handler.erl
index 12300c1c5..7c5925719 100644
--- a/fluxer_gateway/src/gateway/metrics_handler.erl
+++ b/fluxer_gateway/src/gateway/metrics_handler.erl
@@ -7,14 +7,36 @@
 
 -spec init(cowboy_req:req(), term()) -> {ok, cowboy_req:req(), term()}.
 init(Req0, State) ->
-    Body = render_metrics(),
-    Req = cowboy_req:reply(
-        200,
-        #{<<"content-type">> => <<"text/plain; version=0.0.4; charset=utf-8">>},
-        Body,
-        Req0
-    ),
-    {ok, Req, State}.
+    case is_loopback_request(Req0) of
+        false ->
+            Req = cowboy_req:reply(
+                403,
+                #{<<"content-type">> => <<"text/plain">>},
+                <<"FORBIDDEN">>,
+                Req0
+            ),
+            {ok, Req, State};
+        true ->
+            Body = render_metrics(),
+            Req = cowboy_req:reply(
+                200,
+                #{<<"content-type">> => <<"text/plain; version=0.0.4; charset=utf-8">>},
+                Body,
+                Req0
+            ),
+            {ok, Req, State}
+    end.
+
+-spec is_loopback_request(cowboy_req:req()) -> boolean().
+is_loopback_request(Req) ->
+    case cowboy_req:peer(Req) of
+        {{127, 0, 0, 1}, _Port} ->
+            true;
+        {{0, 0, 0, 0, 0, 0, 0, 1}, _Port} ->
+            true;
+        _ ->
+            false
+    end.
 
 -spec render_metrics() -> iolist().
 render_metrics() ->