gru/RustProxy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.34.6

Browse Source
This commit is contained in:
Mateusz Gruszczyński committed 2026-10-21 14:39:51 +02:00
1 parent e037190c14
commit 5cb3b37627
37 files changed
+1031 -138
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/SECURITY.md
+1 -1
View File
@@ -11,7 +11,7 @@ RustProxy provides several security controls, but it is not a complete Web Appli
## Origin and request trust
- Enforce IP/country/DDNS policies, rate limits and HTTP method rules **before** connecting to backends. A Custom location cannot undo a Vhost-level denial.
- Enforce IP/country/DDNS policies, rate limits, HTTP method rules and ordinary Vhost request **Content-Type** deny rules **before** connecting to backends. A Custom location cannot undo a Vhost-level denial. A Content-Type rule is based on the declared request header; a client can omit or mislabel it, so it does not substitute for application or PHP security patches.
- Private and local backend addresses require deliberate exceptions. Routing to the local administration listener can expose secrets or create routing loops.
- HTTPS to a backend is not proof of identity unless upstream certificate/hostname verification is enabled; current backend defaults do **not** enable verification automatically.
- Honor forwarding identity headers only from correctly configured trusted peers. A client can forge arbitrary `X-Forwarded-*` and User-Agent headers.