mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-11 14:58:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(webui): require proxy-generated auth assertions

Browse Source
This commit is contained in:
concertypin
2026-08-04 21:53:16 +08:00
committed by Xubin Ren
parent 465a918cf8
commit e318e21cad
4 changed files with 45 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+5 -3
View File
@@ -116,11 +116,13 @@ This is two-part authorization: a trusted direct loopback peer **and** a
non-empty Cloudflare Access assertion. A trusted CIDR alone is not a bypass.
For this flow `/webui/bootstrap` returns connection metadata without a
bootstrap token or REST API token; the proxy assertion authorizes the WebSocket
handshake and REST requests directly. Nanobot trusts the assertion but does
handshake and REST requests directly. The assertion header must be generated
by Cloudflare Access after authentication; routing/client metadata headers such
as `Host`, `Forwarded`, `X-Forwarded-*`, `X-Real-IP`, and `CF-Connecting-IP`
are rejected as `assertionHeader` values. Nanobot trusts the assertion but does
not cryptographically validate the JWT, so configure the tunnel and Access
policy carefully and do not expose the nanobot listener directly to untrusted
clients. Forwarded client headers such as `X-Forwarded-For` do not establish
proxy trust.
clients. Forwarded client headers do not establish proxy trust.
### Docker Compose