dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): ship trusted-proxy ForwardedHeaders config for Traefik topologies + document lockout-DoS trade-off (plan R2-07 T3)

Browse Source
This commit is contained in:
Joseph Doherty
2026-07-13 10:42:37 -04:00
parent b532a1e30e
commit 24c2097ec3
6 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-env2/central-node-a/appsettings.Central.json
+6 -1
View File
@@ -35,7 +35,12 @@
"JwtExpiryMinutes": 15,
"IdleTimeoutMinutes": 30,
"RequireHttpsCookie": false,
"CookieName": "ZB.MOM.WW.ScadaBridge.Auth.env2"
"CookieName": "ZB.MOM.WW.ScadaBridge.Auth.env2",
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
}
},
"Communication": {
"DeploymentTimeout": "00:02:00",
docker-env2/central-node-b/appsettings.Central.json
+6 -1
View File
@@ -35,7 +35,12 @@
"JwtExpiryMinutes": 15,
"IdleTimeoutMinutes": 30,
"RequireHttpsCookie": false,
"CookieName": "ZB.MOM.WW.ScadaBridge.Auth.env2"
"CookieName": "ZB.MOM.WW.ScadaBridge.Auth.env2",
"ForwardedHeaders": {
"_comment": "Traefik fronts this node on the external scadabridge-net docker network. Trust X-Forwarded-For from the docker bridge address pool so LoginThrottle keys on the real client IP (arch-review R2 N2). Narrow to the Traefik container IP if the network is pinned.",
"Enabled": true,
"KnownNetworks": [ "172.16.0.0/12" ]
}
},
"Communication": {
"DeploymentTimeout": "00:02:00",