From 42804fc55d1c7f9f76d864303e0459bbb30e31a1 Mon Sep 17 00:00:00 2001 From: Blomios Date: Thu, 16 Jul 2026 23:10:47 +0200 Subject: [PATCH] docs(server): documenter --trusted-proxy et l'exigence X-Forwarded-Proto (#72) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Aligne la doc du mode distant sur le durcissement de #72 : exemple complet du cas proxy sur une autre machine avec `--trusted-proxy`, mention que tout bind non-loopback exige au moins un proxy autorisé, et obligation faite au proxy d'envoyer `X-Forwarded-Proto: https`. Précise que transmettre le host public est recommandé pour le diagnostic mais n'est pas la vérification d'accès : celle-ci reste l'égalité stricte d'`Origin` contre `--public-origin`. Bascule les IP d'exemple vers la plage de documentation RFC 5737 (`192.0.2.0/24`) au lieu d'un réseau privé plausible. Co-Authored-By: Claude Opus 4.8 --- docs/server-client-mode-remote.md | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/docs/server-client-mode-remote.md b/docs/server-client-mode-remote.md index f40bf6c..6b1b13d 100644 --- a/docs/server-client-mode-remote.md +++ b/docs/server-client-mode-remote.md @@ -61,18 +61,33 @@ idea --serve \ This example is for a reverse proxy running on the same machine as the server. If the proxy runs on another machine, bind an address reachable by that proxy, -for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that -address and port. The link from proxy to server is still plain HTTP on the LAN; -only the public access is HTTPS. +for example `--listen 192.0.2.75:17373`, and point the proxy upstream to that +address and port. Also authorize only that proxy peer: + +```bash +idea --serve \ + --listen 192.0.2.75:17373 \ + --allow-remote \ + --public-origin https://idea.example.com \ + --trust-reverse-proxy \ + --trusted-proxy 192.0.2.22 +``` + +The link from proxy to server is still plain HTTP on the LAN; only the public +access is HTTPS. For any non-loopback bind, keep the full remote HTTPS configuration: -`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`. -`ServerConfig::validate()` rejects a non-loopback bind without it. +`--allow-remote`, `--public-origin https://...`, `--trust-reverse-proxy`, and at +least one `--trusted-proxy IP_OR_CIDR`. `ServerConfig::validate()` rejects a +non-loopback bind without it. That check covers the configuration, not reality: it cannot verify that a proxy is actually terminating HTTPS in front of the server. Do not expose the backend on a public non-loopback address without TLS proxying. -The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`. +The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`, and +must send `X-Forwarded-Proto: https`. Forwarding the public host is recommended +for diagnostics, but the strict access check remains the `Origin` match against +`--public-origin`. `--public-origin` is matched by strict equality against the request `Origin`: open the UI through the configured domain, not through the server IP, otherwise API calls are rejected with 403.