Nick.Rosenloecher/ApiCore
1
0 Fork 0
Code Issues 22 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): TRUST_PROXY ohne uniquelocal, nur Pod-Netz und Cloudflare
Backend Image / build-and-push (push) Successful in 1m19s
Details
Frontend Image / build-and-push (push) Successful in 30s
Details

Browse Source 
LAN-Adressen als vertrauenswuerdige Hops waren unnoetig weit: Traefik
verwirft X-Forwarded-For von LAN-Clients ohnehin, sie sind selbst Absender.
Vertraut werden nur noch 10.42.0.0/16 (Traefik-Pods) und die Cloudflare-Netze.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Opus 5.5 committed 2026-10-12 09:57:09 +02:00
1 parent 570f4f94e4
commit d7f0d2c13b
2 files changed
+5 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ApiCore-Backend/.env.example
+1 -1
View File
@@ -21,7 +21,7 @@ FRONTEND_ORIGIN="http://localhost:3000"
# Reverse-proxy hops in front of the backend whose X-Forwarded-For is
# trusted (client IP for rate limits and API-key IP allowlists). "1" for the
# single K8s ingress; a list such as "loopback, 10.0.0.0/8" also works.
# Behind Cloudflare + Traefik use "loopback, uniquelocal, <Cloudflare ranges>"
# Behind Cloudflare + Traefik use "loopback, <pod CIDR>, <Cloudflare ranges>"
# (see deploy/k8s/backend/configmap.example.yaml); "1" would yield the
# Cloudflare edge IP that many clients share.
TRUST_PROXY=1