Issue/540 567 no proxy config trusted reverse proxies - #568
Open
hhund wants to merge 31 commits into
Open
Conversation
componentes -> components cComponentes -> components eruComponentes -> components
ARTEFACT -> ARTIFACT artefact -> artifact Artefact -> Artifact
organizatioRoleSystem -> organizationRoleSystem
No method name changes in API interfaces and classes
- Default config sets hostname "proxy" as allowed reverse proxy. - The feature can be disabled by configuring "disabled" as the only allowed reverse proxy. - Hostnames, IPv4/IPv6 addresses and IPv4/IPv6 CIDR networks can be configured as allowed. - Hostnames are resolved against the DNS and periodically refreshed. The timeout can be configured and should be chosen according to the acceptable stale-authorization window and e.g. the expected reverse-proxy replacement time.
- The "dev.dsf.proxy.noProxy" config property can now be configured with exact domains `example.com`, one level wildcard sub-domains `*.example.com`, one or more level wildcard sub-domains `**.example.com`, IP-addresses and CIDR Networks. - IP/CIDR rules are applied if the target URL is specified as an IP-address. - IPv6 addresses and CIDR networks need to be specified in square brackets to allow for the optional specification of a target port. - Examples: sub.exact.com:80, *.one.level.wildcard.com, **.multilevel.com:443, 192.168.1.1, 192.168.1.0/24:80, [2001:db8::1]:443, [2001:db8::/32] - If no port is specified the target port is ignored.
This was
linked to
issues
Aug 16, 2026
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
example.com, one level wildcard sub-domains*.example.com, one or more level wildcard sub-domains**.example.com, IP-addresses and CIDR Networks.closes #540
closes #567
Modified config property
DEV_DSF_PROXY_NOPROXY
example.com, against one level sub-domains*.example.com, one or more level sub-domains**.example.com, against IP-addresses and CIDR Networks if the target URL is specified as IP-address (IPv6 in square brackets), if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supportedsub.exact.com:80, *.one.level.wildcard.com, **.multilevel.com:443, 192.168.1.1, 192.168.1.0/24:80, [2001:db8::1]:443, [2001:db8::/32]New config properties
DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY
disabledto allow all incoming IP addressesproxy, ingress.cluster.local, 192.168.1.1, 192.168.1.0/24, [2001:db8::1], [2001:db8::/32]proxyDEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY_HOSTNAME_REFRESH_TIMEOUT
PT10S