clawbot
35ccb256f9
check / check (push) Waiting to run
For a peer outside SWRP_TRUSTED_PROXIES, rproxy removed a fixed list of traefik's forwarded headers, so names such as X-Forwarded-Ssl and X-Forwarded-Scheme reached the app as the client sent them. An app that reads them could take a plain request for a secure one. Now every header whose name starts with X-Forwarded- is removed before rproxy sets its three, and X-Real-IP as before. A trusted peer's headers pass on unchanged. Model: opus-5-5