blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(server): documenter --trusted-proxy et l'exigence X-Forwarded-Proto (#72)

Browse Source 
Aligne la doc du mode distant sur le durcissement de #72 : exemple complet du
cas proxy sur une autre machine avec `--trusted-proxy`, mention que tout bind
non-loopback exige au moins un proxy autorisé, et obligation faite au proxy
d'envoyer `X-Forwarded-Proto: https`.

Précise que transmettre le host public est recommandé pour le diagnostic mais
n'est pas la vérification d'accès : celle-ci reste l'égalité stricte d'`Origin`
contre `--public-origin`.

Bascule les IP d'exemple vers la plage de documentation RFC 5737 (`192.0.2.0/24`)
au lieu d'un réseau privé plausible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-16 23:10:47 +02:00
parent 75d1ce87fc
commit 42804fc55d
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
docs/server-client-mode-remote.md
View File

@ -61,18 +61,33 @@ idea --serve \
This example is for a reverse proxy running on the same machine as the server. This example is for a reverse proxy running on the same machine as the server.
If the proxy runs on another machine, bind an address reachable by that proxy, If the proxy runs on another machine, bind an address reachable by that proxy,
for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that for example `--listen 192.0.2.75:17373`, and point the proxy upstream to that
address and port. The link from proxy to server is still plain HTTP on the LAN; address and port. Also authorize only that proxy peer:
only the public access is HTTPS.
```bash
idea --serve \
--listen 192.0.2.75:17373 \
--allow-remote \
--public-origin https://idea.example.com \
--trust-reverse-proxy \
--trusted-proxy 192.0.2.22
```
The link from proxy to server is still plain HTTP on the LAN; only the public
access is HTTPS.
For any non-loopback bind, keep the full remote HTTPS configuration: For any non-loopback bind, keep the full remote HTTPS configuration:
`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`. `--allow-remote`, `--public-origin https://...`, `--trust-reverse-proxy`, and at
`ServerConfig::validate()` rejects a non-loopback bind without it. least one `--trusted-proxy IP_OR_CIDR`. `ServerConfig::validate()` rejects a
non-loopback bind without it.
That check covers the configuration, not reality: it cannot verify that a proxy That check covers the configuration, not reality: it cannot verify that a proxy
is actually terminating HTTPS in front of the server. Do not expose the backend is actually terminating HTTPS in front of the server. Do not expose the backend
on a public non-loopback address without TLS proxying. on a public non-loopback address without TLS proxying.
The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`. The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`, and
must send `X-Forwarded-Proto: https`. Forwarding the public host is recommended
for diagnostics, but the strict access check remains the `Origin` match against
`--public-origin`.
`--public-origin` is matched by strict equality against the request `Origin`: `--public-origin` is matched by strict equality against the request `Origin`:
open the UI through the configured domain, not through the server IP, otherwise open the UI through the configured domain, not through the server IP, otherwise
API calls are rejected with 403. API calls are rejected with 403.