kallithea Files · docs/index.rst

Files @ f08fbf424898

Branch filter:

Location: kallithea/docs/index.rst

f08fbf424898 1.2 KiB text/prs.fallenstein.rst Show Annotation Show as Raw Download as Raw

mads

auth: don't trust clients too much - only trust the *last* IP in the X-Forwarded-For header

The X-Forwarded-For header contains a list of IP addresses, where each
proxy server appends the IP they see their request coming from.
See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For .

Trusting the *first* IP in HTTP_X_FORWARDED_FOR would allow clients to claim
any IP, which could be used to bypass IP restrictions configured in Kallithea.

Instead, only trust the last proxy in the chain, and thus only use the *last*
IP in HTTP_X_FORWARDED_FOR. (In setups where more than last IP should be
trusted, the last proxy server in the chain must be configured rewrite the
header accordingly.)

.. _index:

#######################
Kallithea Documentation
#######################

* :ref:`genindex`
* :ref:`search`


Readme
******

.. toctree::
   :maxdepth: 1

   readme


Administrator guide
*******************

**Installation and upgrade**

.. toctree::
   :maxdepth: 1

   overview
   installation
   installation_win
   installation_win_old
   installation_iis
   installation_puppet
   upgrade

**Setup and configuration**

.. toctree::
   :maxdepth: 1

   setup
   administrator_guide/auth
   administrator_guide/vcs_setup
   usage/email
   usage/customization

**Maintenance**

.. toctree::
   :maxdepth: 1

   usage/backup
   usage/performance
   usage/debugging
   usage/troubleshooting


User guide
**********

.. toctree::
   :maxdepth: 1

   usage/general
   usage/vcs_notes
   usage/statistics
   api/api


Developer guide
***************

.. toctree::
   :maxdepth: 1

   contributing
   dev/i18n
   dev/dbmigrations


.. _python: http://www.python.org/
.. _django: http://www.djangoproject.com/
.. _mercurial: https://www.mercurial-scm.org/
.. _git: http://git-scm.com/
.. _celery: http://celeryproject.org/
.. _Sphinx: http://sphinx.pocoo.org/
.. _vcs: http://pypi.python.org/pypi/vcs