adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 02:42:21 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Always trust reverse proxy on localhost without additional configuration #600

New Issue
Closed
opened 2026-10-05 04:32:34 +02:00 by adam · 1 comment
adam commented 2026-10-05 04:32:34 +02:00
Owner
Copy link
Copy source

Currently TrustedProxy = whatever must be specified in the config file by hand. I think that ZNC should automatically trust 127.0.0.0/8 and ::1 as something on localhost sending the X-Real-IP or X-Forwarded-For is setup by administrator or otherwise trusted.

With external hosts there is no way to know who has set the reverse proxy or if the user even is a reverse proxy, so TrustedProxy should be left for those.

  • Debian GNU/Linux 7.9 (wheezy)
  • ZNC 1.7.x-git-441-d66cb36 - http://znc.in
    • IPv6: yes, SSL: yes, DNS: threads, charset: yes
Currently `TrustedProxy = whatever` must be specified in the config file by hand. I think that ZNC should automatically trust `127.0.0.0/8` and `::1` as something on localhost sending the `X-Real-IP` or `X-Forwarded-For` is setup by administrator or otherwise trusted. With external hosts there is no way to know who has set the reverse proxy or if the user even is a reverse proxy, so `TrustedProxy` should be left for those. - Debian GNU/Linux 7.9 (wheezy) - ZNC 1.7.x-git-441-d66cb36 - http://znc.in - IPv6: yes, SSL: yes, DNS: threads, charset: yes <!-- github-sync-id:108442811 -->
adam closed this issue 2026-10-05 04:32:34 +02:00
adam commented 2026-10-05 04:32:35 +02:00
Author
Owner
Copy link
Copy source
2015-09-26 08:54:38+0300 < kerio> hell naw
2015-09-26 08:54:56+0300 < Mikaela> if naw is no, why not?
2015-09-26 08:55:21+0300 < kerio> that only works if you completely trust all the users on your box
2015-09-26 08:56:02+0300 < Mikaela> I don'ẗ think that is required as the reverse proxy makes no sense on other ports than 80/443 which are root controlled
2015-09-26 08:56:15+0300 < kerio> what
2015-09-26 08:56:20+0300 < Mikaela> and why would users on the box send false headers?
2015-09-26 08:56:52+0300 < kerio> even a supposed privileged web server won't connect to your znc from port 80
2015-09-26 08:57:13+0300 < kerio> and they'll send false headers because they're dicks, duh

I want to believe that people are better than that, but maybe that blocks this anyway.

``` 2015-09-26 08:54:38+0300 < kerio> hell naw 2015-09-26 08:54:56+0300 < Mikaela> if naw is no, why not? 2015-09-26 08:55:21+0300 < kerio> that only works if you completely trust all the users on your box 2015-09-26 08:56:02+0300 < Mikaela> I don'ẗ think that is required as the reverse proxy makes no sense on other ports than 80/443 which are root controlled 2015-09-26 08:56:15+0300 < kerio> what 2015-09-26 08:56:20+0300 < Mikaela> and why would users on the box send false headers? 2015-09-26 08:56:52+0300 < kerio> even a supposed privileged web server won't connect to your znc from port 80 2015-09-26 08:57:13+0300 < kerio> and they'll send false headers because they're dicks, duh ``` I want to believe that people are better than that, but maybe that blocks this anyway. <!-- github-comment-id:143401536 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#600