fix(proxy): replace changeOrigin changes in 5.3.0 with new rewriteWsOrigin option

[johnhunter]

Description

fixes #17562
fixes #17520

This PR reverts the change to the changeOrigin option released in 5.3.0 and adds an alternative solution:

• A new rewriteWsOrigin option which rewrites the Origin header for WebSocket requests only
• Check for headersSent prior to rewriting, logging a warning if it does not rewrite
• Update docs for new option and warns about the security implications

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[pfdgithub]

Maybe a rewriteHttpOrigin option should be added as well?

[johnhunter]

Maybe a rewriteHttpOrigin option should be added as well?

I haven't seen a use case for that yet, and given rewriting the Origin has security implications I'd prefer to not implement. If a need arises later we could revisit it.

[pfdgithub]

Maybe a rewriteHttpOrigin option should be added as well?

I haven't seen a use case for that yet, and given rewriting the Origin has security implications I'd prefer to not implement. If a need arises later we could revisit it.

I have seen this use case:
Proxying to grafana server, i need to specify the Origin option in the headers.

Due to the diversity in HTTP implementation, compared to WebSocket, HTTP has more use cases where Origin checking is necessary.

[bluwy]

LGTM. Would also like @sapphi-red's eye on this in case I miss something

@pfdgithub I'm leaning towards fixing the regression first and we could revisit if we need rewriteHttpOrigin later. Since this introduces a new option, we'd need the team's opinion on this first, and introducing 2 new options may be more complicated.

[pfdgithub]

LGTM. Would also like @sapphi-red's eye on this in case I miss something

@pfdgithub I'm leaning towards fixing the regression first and we could revisit if we need rewriteHttpOrigin later. Since this introduces a new option, we'd need the team's opinion on this first, and introducing 2 new options may be more complicated.

The 'rewriteHttpOrigin' option is not required, there are other ways to implement it.
Thank you for your work and all the best.

[sapphi-red]

LGTM, thanks for the PR!

Re rewriteHttpOrigin, I think we should have it if we have rewriteWsOrigin for consistency. (I'm fine with doing that in a separate PR)