v0.31.4

docs/API_ACCESS.md

@@ -9,16 +9,17 @@ new bind address and allow explicit DNS hostnames. A persisted non-loopback bind
 accepted when HTTPS is enabled. The legacy startup flags remain only for deliberately
 plain remote HTTP. Public vhost `/docs` paths are not captured by the admin listener.
 
-When the dashboard is published through a trusted reverse proxy, an explicit
-`administration.allowed_hosts` DNS entry is matched against the external authority rather
-than the private admin socket port. `X-Forwarded-Host` is trusted only from loopback or a
+When the dashboard is published through a trusted reverse proxy, the hostname of
+the optional `administration.public_origin` is automatically allowed for panel
+Host validation. Any extra `administration.allowed_hosts` DNS entry is also
+matched against the external authority rather than the private admin socket port. `X-Forwarded-Host` is trusted only from loopback or a
 configured trusted proxy; the external `X-Forwarded-Proto` additionally requires the
 forwarded-proto trust setting except for loopback. Origin/CSRF checks and Secure cookies use
 that external origin. Direct IP/localhost access still requires the real administration port.
 
 ### Publishing the panel through RustProxy itself
 
-0.16.0 supports the explicitly opted-in same-process topology where a public HTTPS vhost proxies to the local administration listener. The reserved `rustproxy_session` cookie is passed through only when all of these conditions are true: the browser-facing request is TLS, its DNS hostname is explicitly present in `administration.allowed_hosts`, the selected backend directly addresses the configured administration socket by IP, and that backend has `accept_local_listener_risk=true`. The control-plane route is forced out of shared cache.
+0.16.0 supports the explicitly opted-in same-process topology where a public HTTPS vhost proxies to the local administration listener. The reserved `rustproxy_session` cookie is passed through only when all of these conditions are true: the browser-facing request is TLS, its DNS hostname either matches the pinned `administration.public_origin` or is explicitly listed in `administration.allowed_hosts`, the selected backend directly addresses the configured administration socket by IP, and that backend has `accept_local_listener_risk=true`. The control-plane route is forced out of shared cache.
 
 This is a narrow exception to the normal isolation rule. For every ordinary backend RustProxy still removes `rustproxy_session` before forwarding requests and strips an upstream attempt to set that cookie in responses. DNS backend names are not accepted for the special self-admin cookie path. This prevents a normal application backend from reading or replacing the administration session.