blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
611717795732b8c5e193dffc62a28e9ef0b3ba63
IdeA/docs/server-client-mode-remote.md
Blomios d538808a0d feat(server): servir dist same-origin + durcissement (logout, logs sécurité, static hardening) (#13) 
Sert le bundle web (dist/) en same-origin via --web-root / IDEA_WEB_ROOT
ou le web/ packagé. serve_static durci : anti path-traversal, typage MIME,
X-Content-Type-Options nosniff, CSP, fallback SPA. Ajoute POST /api/logout
qui révoque la session HTTP + WS, et une journalisation sécurité via
SecurityLogger. Documente le déploiement remote (dev local, packaging web/,
reverse proxy HTTPS).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 08:10:31 +02:00

1.4 KiB
Raw Blame History

IdeA Server/Client Remote Deployment

idea --serve serves the web UI and the API from the same origin. The frontend build must be available as a web root containing index.html.

Local Development

pnpm --dir frontend build
idea --serve --web-root frontend/dist

The default local listener is 127.0.0.1:17373. Loopback development may use plain HTTP; the session cookie is still HttpOnly and SameSite=Strict.

Packaged Artifact

The release artifact is still a single IdeA binary/AppImage. Packaging must copy the frontend build output (frontend/dist) into the packaged web/ resource next to the binary. idea --serve resolves assets in this order:

  1. --web-root PATH
  2. IDEA_WEB_ROOT
  3. packaged web/, then packaged frontend/dist/
  4. development fallback frontend/dist relative to the current directory

If no index.html is found, the server refuses to start.

Remote HTTPS

Public exposure requires a reverse proxy that terminates HTTPS:

idea --serve \
  --listen 127.0.0.1:17373 \
  --allow-remote \
  --public-origin https://idea.example.com \
  --trust-reverse-proxy

The proxy must forward the same origin for the SPA, /api/*, and /api/ws. Do not expose the backend on a public non-loopback address without TLS proxying. Secrets must never be placed in URLs; pairing uses POST /api/pair and then an HttpOnly, Secure, SameSite=Strict session cookie.