08ce94d1c0
The real-client-IP lookup used by the --trusted-ip auth-bypass allowlist blindly trusted the leftmost value in X-Forwarded-For (or other configured --real-client-ip-header). When trusting X-Forwarded-For (which is the only header set by AWS ALB for example) the connecting peer's address is appended to X-Forwarded-For rather than replacing the header, and a client could set X-Forwarded-For to an allowlisted IP and have it trusted regardless of who actually connected to the proxy. The parser now walks the hop chain from the newest (rightmost) entry inward, skipping hops that are themselves trusted proxies, and returns the first entry that isn't. If the direct connecting peer isn't itself a trusted proxy, the header is ignored entirely. This reuses the existing --trusted-proxy-ip configuration, so behavior for deployments that leave it unset (today's documented trust-all default) is unchanged. Signed-off-by: Georgi Georgiev <310867+chutzimir@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| docs | ||
| src/css | ||
| static | ||
| versioned_docs | ||
| versioned_sidebars | ||
| .gitignore | ||
| README.md | ||
| babel.config.js | ||
| docusaurus.config.js | ||
| package.json | ||
| sidebars.js | ||
| versions.json | ||
README.md
Website
This website is built using Docusaurus 2, a modern static website generator.
Installation
npm install
Local Development
npm start
This command starts a local development server and open up a browser window. Most changes are reflected live without having to restart the server.
Build
npm run build
This command generates static content into the build directory and can be served using any static contents hosting service.
Deployment
GIT_USER=<Your GitHub username> USE_SSH=true npm deploy
If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.