-
-
Notifications
You must be signed in to change notification settings - Fork 756
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Docs: clarify how to use proxy-headers with unix sockets #713
Comments
would be a good addition yes, PR welcome @PeterJCLaw :) |
So I had a quick look into the internals here and I can't see an easy way to be confident in the middleware that the connection is a unix socket. I think that ideally we'd get something in
Is there something I'm missing here which might make this possible, or is documenting the behaviour the only solution? (I'm happy to look at doing that anyway, just would be nice for it to work automatically) |
It is unfortunately non-obvious that when using an unix socket, clients connecting to that socket are not trusted as a source of headers for proxying to the underlying application. Fixes encode#713
It is unfortunately non-obvious that when using an unix socket, clients connecting to that socket are not trusted as a source of headers for proxying to the underlying application. Fixes encode#713
It is unfortunately non-obvious that when using an unix socket, clients connecting to that socket are not trusted as a source of headers for proxying to the underlying application. Fixes #713
It is unfortunately non-obvious that when using an unix socket, clients connecting to that socket are not trusted as a source of headers for proxying to the underlying application. Fixes encode/uvicorn#713
It is unfortunately non-obvious that when using an unix socket, clients connecting to that socket are not trusted as a source of headers for proxying to the underlying application. Fixes encode/uvicorn#713
It would be great if it could be documented that when using a unix socket the client address which
ProxyHeadersMiddleware
gets will beNone
and that you therefore need to pass*
as the trusted hosts to get the proxy headers to work.Even better would be for the proxy headers to "just work" when using a unix socket, in the same way that
ProxyHeadersMiddleware
trusts localhost by default, though I suspect that may be more involved.The text was updated successfully, but these errors were encountered: