improve localhost_admin security against proxy misconfiguration
Massimo Melina committed
May 22, 2026 at 18:52 UTC
864c89c8003dc256e7f52f74c7d4456d1d6fb22b
1 file changed
+2
-2
src/adminApis.ts
+2
-2
@@ -213,8 +213,8 @@ export const title = defineConfig('title', "File server")
213
export function ctxAdminAccess(ctx: Koa.Context) {
214
if (preventAdminAccess(ctx))
215
return false
216
- // for extra security, skip localhost_admin via proxy, even tho this prevents using it with local proxies, which is legit in principle
217
- return !ctx.ips.length && localhostAdmin.get() && isLocalHost(ctx)
216
+ // whenProxyDetected covers both trusted and misconfigured proxies, so localhost_admin never trusts proxied localhost claims
217
+ return !ctx.state.whenProxyDetected && localhostAdmin.get() && isLocalHost(ctx)
218
|| ctx.state.account && accountCanLoginAdmin(ctx.state.account)
219
}
220