blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(server): documenter --trusted-proxy et l'exigence X-Forwarded-Proto (#72)

Browse Source 
Aligne la doc du mode distant sur le durcissement de #72 : exemple complet du
cas proxy sur une autre machine avec `--trusted-proxy`, mention que tout bind
non-loopback exige au moins un proxy autorisé, et obligation faite au proxy
d'envoyer `X-Forwarded-Proto: https`.

Précise que transmettre le host public est recommandé pour le diagnostic mais
n'est pas la vérification d'accès : celle-ci reste l'égalité stricte d'`Origin`
contre `--public-origin`.

Bascule les IP d'exemple vers la plage de documentation RFC 5737 (`192.0.2.0/24`)
au lieu d'un réseau privé plausible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-16 23:10:47 +02:00
parent 75d1ce87fc
commit 42804fc55d
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
docs/server-client-mode-remote.md
View File

@ -61,18 +61,33 @@ idea --serve \
This example is for a reverse proxy running on the same machine as the server.
If the proxy runs on another machine, bind an address reachable by that proxy,
for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that
address and port. The link from proxy to server is still plain HTTP on the LAN;
only the public access is HTTPS.
for example `--listen 192.0.2.75:17373`, and point the proxy upstream to that
address and port. Also authorize only that proxy peer:
```bash
idea --serve \
--listen 192.0.2.75:17373 \
--allow-remote \
--public-origin https://idea.example.com \
--trust-reverse-proxy \
--trusted-proxy 192.0.2.22
```
The link from proxy to server is still plain HTTP on the LAN; only the public
access is HTTPS.
For any non-loopback bind, keep the full remote HTTPS configuration:
`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`.
`ServerConfig::validate()` rejects a non-loopback bind without it.
`--allow-remote`, `--public-origin https://...`, `--trust-reverse-proxy`, and at
least one `--trusted-proxy IP_OR_CIDR`. `ServerConfig::validate()` rejects a
non-loopback bind without it.
That check covers the configuration, not reality: it cannot verify that a proxy
is actually terminating HTTPS in front of the server. Do not expose the backend
on a public non-loopback address without TLS proxying.
The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`.
The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`, and
must send `X-Forwarded-Proto: https`. Forwarding the public host is recommended
for diagnostics, but the strict access check remains the `Origin` match against
`--public-origin`.
`--public-origin` is matched by strict equality against the request `Origin`:
open the UI through the configured domain, not through the server IP, otherwise
API calls are rejected with 403.