DokuWiki

It's better when it's simple

User Tools

Site Tools


config:trustedproxy

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
config:trustedproxy [2020-06-14 00:50]
phy25 Add Hogfather information
config:trustedproxy [2020-06-14 00:56] (current)
phy25 there was some trust implemented there
Line 5: Line 5:
 When running it behind a reverse proxy, the directly requesting IP is always the proxy address which is useless for the mentioned purpose. Instead the ''HTTP_X_FORWARDED_FOR'' and ''HTTP_X_REAL_IP'' headers are used to determine the original IP address. When running it behind a reverse proxy, the directly requesting IP is always the proxy address which is useless for the mentioned purpose. Instead the ''HTTP_X_FORWARDED_FOR'' and ''HTTP_X_REAL_IP'' headers are used to determine the original IP address.
  
-Starting Hogfather, this header is only trusted if the request is coming from an IP matching the regular expression in this config option, to avoid that malicious users spoof this header. Before Hogfather, any HTTP request with this header will be trusted.+Starting Hogfather, this header is only trusted if the request is coming from an IP matching the regular expression in this config option, to avoid that malicious users spoof this header. Before Hogfather, the code had some check against local IP address, but the behavior was non-standard and not secure enough.
  
 The default value trusts local network IPs only. Emptying this setting will make DokuWiki never trust the forward headers. The default value trusts local network IPs only. Emptying this setting will make DokuWiki never trust the forward headers.
config/trustedproxy.txt ยท Last modified: 2020-06-14 00:56 by phy25