From 873b71277456b69f6f49cf1b0548c3d59d732b18 Mon Sep 17 00:00:00 2001 From: dsh Date: Sun, 16 Aug 2026 02:21:22 -0400 Subject: [PATCH] docs: reverse proxy must also strip Origin upstream The browser-trust fence verifies Origin == Host after the loopback pin; with Host presented as loopback the browser's public Origin can never match (403 on every /api POST). Strip the Origin header in the proxy so the fence falls back to its Sec-Fetch-Site cross-site check, while panel-auth's cookie auth remains the real gate. --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index fcf8543..d17f38e 100644 --- a/README.md +++ b/README.md @@ -74,10 +74,15 @@ Host 以回环形式转发给面板，否则这些方法返回 `403 forbidden` dsh.example.com { reverse_proxy 127.0.0.1:3080 { header_up Host 127.0.0.1 + header_up -Origin } } ``` +- 为什么删 `Origin`：围栏同时校验 `Origin == Host`；Host 呈回环时浏览器 + 携带的对外 Origin 必然不相等（全部 403）。删除后围栏改走 + `Sec-Fetch-Site: cross-site` 检查（现代浏览器都发）拦截跨站，且所有请求 + 仍有 panel-auth 的密码/Cookie 层把关（跨站请求带不上 SameSite=Lax Cookie）。 - 认证不受影响：所有请求仍先过 panel-auth（密码/Cookie + 防爆破）， 且 panel-auth 的 Cookie 是浏览器端存储，与 Host 头无关。 - panel-auth 的来源校验在 Host 为回环时自动跳过（代理场景）；对外域名下的