dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): ship trusted-proxy ForwardedHeaders config for Traefik topologies + document lockout-DoS trade-off (plan R2-07 T3)

Browse Source
This commit is contained in:
Joseph Doherty
2026-07-13 10:42:37 -04:00
parent b532a1e30e
commit 24c2097ec3
6 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/central-node-a/appsettings.Central.json
+6 -1
View File
@@ -38,7 +38,12 @@
"JwtSigningKey": "scadabridge-dev-jwt-signing-key-must-be-at-least-32-characters-long",
"JwtExpiryMinutes": 15,
"IdleTimeoutMinutes": 30,
"RequireHttpsCookie": false
"RequireHttpsCookie": false,
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
}
},
"Communication": {
"DeploymentTimeout": "00:02:00",
docker/central-node-b/appsettings.Central.json
+6 -1
View File
@@ -38,7 +38,12 @@
"JwtSigningKey": "scadabridge-dev-jwt-signing-key-must-be-at-least-32-characters-long",
"JwtExpiryMinutes": 15,
"IdleTimeoutMinutes": 30,
"RequireHttpsCookie": false
"RequireHttpsCookie": false,
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
}
},
"Communication": {
"DeploymentTimeout": "00:02:00",