sneak/webhooker

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333) #336

Merged

clawbot merged 6 commits from issue-333-trust-rfc1918-proxies into next

2026-10-02 00:41:37 +02:00

Author	SHA1	Message	Date
sneak	72b5bf32a4	Key the TRUSTED_PROXIES rule to the source address seen on arrival check / check (push) Successful in 4m37s Details The README and the TrustedProxies comment now say, once per passage, that the list must be set to the proxy's address alone if any client can reach webhooker or the proxy from an RFC 1918 source address, directly or through anything that can rewrite source addresses, and that the address to set is the remoteIP field of the http request log line. The loopback case in the reverse-proxy checklist is now a proxy reaching the binary bound to 127.0.0.1. Other sentences about which clients can choose their own rate-limit key are cut. Model: opus-5-5	2026-10-01 21:50:35 +00:00
sneak	364ce11500	Name every rate limit that shares the client key "Trusted proxies" now says a block covering clients makes every rate limit bypassable, not "all three"; Rate Limiting lists delivery replay and event resubmit among the limiters sharing the key. The Configuration table and the TrustedProxies comment say a private client behind a trusted proxy chooses its key, not behind any proxy. Model: opus-5-5	2026-10-01 21:50:35 +00:00
sneak	1c2b09f283	Say the proxy is covered by default or by a set value The rate-limit test comments on trustedProxyCIDR and forwardedKeyFor said production needs TRUSTED_PROXIES set; another said only operator-listed addresses are trusted. The README's Rate Limiting paragraph said "listed in", and the login endpoint section assumed every proxied deployment shares one bucket. All now match the RFC 1918 default. Model: opus-5-5	2026-10-01 21:50:35 +00:00
clawbot	8407ca2496	Point to the proxy's access log for a login flood's source No log line records the client address taken from X-Forwarded-For, so the login endpoint section no longer says the source shows in the failure logs; it names the proxy's access log instead. Model: opus-5-5	2026-10-01 21:50:35 +00:00
clawbot	4fe14a2a99	Say that any private-addressed client can choose its rate-limit key Under the default, a client with a private address picks its own rate-limit key through X-Forwarded-For whether it connects directly or through the proxy, so the README and the TrustedProxies comment now tell an operator with any such clients to set the list to the proxy alone. The login endpoint section no longer assumes the proxy is uncovered by default. Model: opus-5-5	2026-10-01 21:50:35 +00:00
clawbot	ca9c316680	Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333 ) Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching the app over a Docker network or a private LAN gets per-client rate-limit buckets without configuration. A set value replaces the default; an unparseable one still fails startup. The startup warning for an empty list goes, with its test hook and test, since the default is no longer empty. The README's configuration table, Trusted proxies, upaas and reverse-proxy sections describe the new default and when to narrow it to the proxy alone. Model: opus-5-5	2026-10-01 21:50:35 +00:00