Repository navigation
Docs: allowed_hosts never lists the name a proxy rewrites Host to - #705
Merged
Merged
Conversation
The comment on server.allowed_hosts (config.rs, forge.toml.example) advised adding the name a reverse proxy rewrites Host to. With such a name every request names an allowed host, and the trusted-header realms' DNS-rebinding guard is off. The comment now says the proxy must forward the client's own Host and that a rewritten name must never be listed; the deployment guide's trusted-header section says the same. Fixes #583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012e6DJXRhLYxFjzrWiwKFKc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #583
The comment on
server.allowed_hostsadvised adding "the name a reverse proxy rewritesHostto", for exampleforgefor an nginxproxy_pass http://forge:8421withoutproxy_set_header Host $host. With that entry every request names an allowed host, which turns off the trusted-header realms' DNS-rebinding guard. The advice predates 2.1.0 and the removed allowlist mode.Changes
crates/server/src/config.rsandforge.toml.example: the comment now gives an internal client name as its example. It says the guard needs the client's ownHost, so the proxy must forward it (nginx:proxy_set_header Host $host). It also says never to add a name the proxy rewritesHostto, because the guard is then off.docs/deployment.md, Trusted-header realms: the bullet on when the headers count says the same, with the nginx example.docs/changes/2.2.0/583.docs.md.The realm form (Admin → Authentication) already says "Forward Forge's own host name", so it is unchanged.
docs/docker.mdasks to keepHostintact for a repository'shosttoo, so it is unchanged as well.Checks run
cargo fmt --all --check,cargo build -p forge-server,cargo xtask changelog --check,cargo xtask docs --check.Generated by Claude Code