mosaicstack/stack
25
0
Fork 1
Code Issues 360 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

docs: row 74 brief, header name case and proxy Host rule (#1568)

Browse Source 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-10-11 17:04:48 -05:00
co-authored by Claude Opus 5.5
parent e1837ec689
commit 9f6c63b202
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-10-11_webui-preview.md
+9 -3
View File
@@ -55,8 +55,12 @@ exactly as today, and the existing tests show it.
- `serve --public-host NAME --auth-header HEADER --allow-user ID`, all - `serve --public-host NAME --auth-header HEADER --allow-user ID`, all
three or none. The check is generic: one header name and one user id, three or none. The check is generic: one header name and one user id,
both from the flags, nothing provider-specific in code or tests. NAME is a hostname, no port or scheme. The bind stays both from the flags, nothing provider-specific in code or tests.
loopback; nothing here listens beyond it. Node lowercases incoming header names, so HEADER matches without
regard to case (`X-authentik-uid` on the flag finds
`x-authentik-uid`), and a test shows it. The value compare is exact.
NAME is a hostname, no port or scheme. The bind stays loopback;
nothing here listens beyond it.
- In preview mode a request's Host must be NAME, or loopback on the - In preview mode a request's Host must be NAME, or loopback on the
Console's port as today. An Origin, when sent, must be `https://NAME` Console's port as today. An Origin, when sent, must be `https://NAME`
for a NAME request, and the loopback form for a loopback request. for a NAME request, and the loopback form for a loopback request.
@@ -75,7 +79,9 @@ exactly as today, and the existing tests show it.
- The README replaces "Do not expose either unauthenticated server - The README replaces "Do not expose either unauthenticated server
through a public proxy" with what the preview mode requires of the through a public proxy" with what the preview mode requires of the
proxy: it strips HEADER from every client request and sets it only proxy: it strips HEADER from every client request and sets it only
after the identity provider signs the user in, it preserves Host, it terminates TLS, after the identity provider signs the user in, it forwards only
requests whose Host is NAME and preserves that Host (a forwarded
loopback Host would skip the header check), it terminates TLS,
and it is the only thing that reaches the port from off the host. It and it is the only thing that reaches the port from off the host. It
says plainly that any local process can still connect and send HEADER, says plainly that any local process can still connect and send HEADER,
the same exposure the README already describes for the port. the same exposure the README already describes for the port.