blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(server): clarifier le bind du cas proxy distant et l'origine stricte (#65)

Browse Source 
L'exemple du cas « Remote HTTPS » bindait `127.0.0.1` en supposant sans le dire
que le reverse proxy tourne sur la même machine que le serveur. Suivi tel quel
avec un proxy sur une autre machine, il produit un serveur injoignable — ce qui
a réellement induit l'utilisateur en erreur aujourd'hui.

Précise donc : le cas co-localisé vs le cas proxy distant (binder une adresse
joignable par le proxy, lien proxy→serveur en HTTP clair sur le LAN), la
configuration exigée pour tout bind non-loopback, l'égalité stricte de
`--public-origin` contre l'`Origin` de la requête (ouvrir l'UI par le domaine et
non par l'IP, sinon 403), et le pare-feu hôte comme cause de timeout depuis les
autres machines.

Indépendant de #68 et #71 : valeur immédiate, n'attend aucun de leurs lots.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-16 18:11:56 +02:00
parent 56b9f5f619
commit 77684ea183
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/server-client-mode-remote.md
View File

@ -59,8 +59,24 @@ idea --serve \
--trust-reverse-proxy
```
This example is for a reverse proxy running on the same machine as the server.
If the proxy runs on another machine, bind an address reachable by that proxy,
for example `--listen 192.168.1.75:17373`, and point the proxy upstream to that
address and port. The link from proxy to server is still plain HTTP on the LAN;
only the public access is HTTPS.
For any non-loopback bind, keep the full remote HTTPS configuration:
`--allow-remote`, `--public-origin https://...`, and `--trust-reverse-proxy`.
`ServerConfig::validate()` rejects a non-loopback bind without it.
The proxy must forward the same origin for the SPA, `/api/*`, and `/api/ws`.
Do not expose the backend on a public non-loopback address without TLS proxying.
`--public-origin` is matched by strict equality against the request `Origin`:
open the UI through the configured domain, not through the server IP, otherwise
API calls are rejected with 403.
With a LAN bind, also check the host firewall. If the server is reachable from
the local machine but times out from every other host, open the port for the LAN
subnet or, preferably, only for the proxy IP. Avoid opening it broadly: the
server does not provide its own TLS.
Secrets must never be placed in URLs; pairing uses `POST /api/pair` and then an
`HttpOnly`, `Secure`, `SameSite=Strict` session cookie.