diff options
| author | Michael Peter Christen <mc@yacy.net> | 2026-07-12 17:16:24 +0200 |
|---|---|---|
| committer | Michael Peter Christen <mc@yacy.net> | 2026-07-12 17:16:24 +0200 |
| commit | ece7985d9435843989c36395c6dd2db2f0b9e933 (patch) | |
| tree | b54c2eb1f273a4c716470b5aa90ab67b83b35a4b /help | |
| parent | 92e0b111a0ce98964e4de3600d1a81643313ed7e (diff) | |
proper IP recognition using header X-Real-IP when YaCy is behind a
reverse proxy
Diffstat (limited to 'help')
| -rw-r--r-- | help/AccessTracker_p.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/help/AccessTracker_p.md b/help/AccessTracker_p.md index 8b3158593..09684e4bc 100644 --- a/help/AccessTracker_p.md +++ b/help/AccessTracker_p.md @@ -62,6 +62,14 @@ GET or POST /AccessTracker_p.html?host=...&page=... Expect observations: counts, logs, queues, timing, network rows, thread states, or resource values. Monitoring does not fix the issue by itself; it points to the next page or setting to change. +When YaCy is reached through a reverse proxy, Access Tracker uses `X-Real-IP` +only when the proxy's direct socket IP matches one of the comma-separated regular +expressions in `server.reverseProxy.trusted`. Loopback proxies are trusted by +default. Authentication and access-control decisions continue to use the direct +socket IP, not the forwarded address. The reverse proxy must overwrite +`X-Real-IP` with the client address; it must not pass a client-supplied value +unchanged. + ## Related Pages - `yacysearch.html` |