Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOC Mention that SS_TRUSTED_PROXY_IPS supports subnets #377

Merged
merged 2 commits into from
Oct 19, 2023
+8 −1
Merged

DOC Mention that SS_TRUSTED_PROXY_IPS supports subnets #377

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a996692
DOC Mention that SS_TRUSTED_PROXY_IPS supports subnets
johannesx75 Oct 17, 2023
3e54617
Apply suggestions from code review
johannesx75 Oct 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion en/02_Developer_Guides/09_Security/04_Secure_Coding.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -673,6 +673,13 @@ server IPs using the SS_TRUSTED_PROXY_IPS define in your `.env`.
SS_TRUSTED_PROXY_IPS="127.0.0.1,192.168.0.1"
```

You can also whitelist subnets in CIDR notation if you don't know the exact IP of a trusted proxy.
For example, some cloud provider load balancers don't have fixed IPs.

```
SS_TRUSTED_PROXY_IPS="10.10.0.0/24,10.10.1.0/24,10.10.2.0/24"
```

If you wish to change the headers that are used to find the proxy information, you should reconfigure the
TrustedProxyMiddleware service:

Expand All @@ -695,7 +702,7 @@ At the same time, you'll also need to define which headers you trust from these

If there is no proxy server, 'none' can be used to distrust all clients.
If only trusted servers will make requests then you can use '*' to trust all clients.
Otherwise a comma separated list of individual IP addresses should be declared.
Otherwise a comma separated list of individual IP addresses (or subnets in CIDR notation) should be declared.

This behaviour is enabled whenever `SS_TRUSTED_PROXY_IPS` is defined, or if the
`BlockUntrustedIPs` environment variable is declared. It is advisable to include the
Expand Down