kevin/panel-auth
1
0 Fork 0
forked from dsh/panel-auth
Code Pull Requests Activity

docs: reverse proxy must also strip Origin upstream

Browse Source 
The browser-trust fence verifies Origin == Host after the loopback pin;
with Host presented as loopback the browser's public Origin can never
match (403 on every /api POST). Strip the Origin header in the proxy so
the fence falls back to its Sec-Fetch-Site cross-site check, while
panel-auth's cookie auth remains the real gate.
This commit is contained in:
dsh
2026-08-16 02:21:22 -04:00
parent ddb32ce129
commit 873b712774
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5
View File
@@ -74,10 +74,15 @@ Host 以回环形式转发给面板，否则这些方法返回 `403 forbidden`
dsh.example.com { dsh.example.com {
reverse_proxy 127.0.0.1:3080 { reverse_proxy 127.0.0.1:3080 {
header_up Host 127.0.0.1 header_up Host 127.0.0.1
header_up -Origin
} }
} }
``` ```
- 为什么删 `Origin`：围栏同时校验 `Origin == Host`；Host 呈回环时浏览器
携带的对外 Origin 必然不相等（全部 403）。删除后围栏改走
`Sec-Fetch-Site: cross-site` 检查（现代浏览器都发）拦截跨站，且所有请求
仍有 panel-auth 的密码/Cookie 层把关（跨站请求带不上 SameSite=Lax Cookie）。
- 认证不受影响：所有请求仍先过 panel-auth（密码/Cookie + 防爆破）， - 认证不受影响：所有请求仍先过 panel-auth（密码/Cookie + 防爆破），
且 panel-auth 的 Cookie 是浏览器端存储，与 Host 头无关。 且 panel-auth 的 Cookie 是浏览器端存储，与 Host 头无关。
- panel-auth 的来源校验在 Host 为回环时自动跳过（代理场景）；对外域名下的 - panel-auth 的来源校验在 Host 为回环时自动跳过（代理场景）；对外域名下的