sims-hq

Commit Graph

Author	SHA1	Message	Date
Thomas Joise	1d715e6a64	fix(sec/d24): nginx sends X-Forwarded-For as $remote_addr (replace, not append) With the app's trust-proxy=1, an appended client-supplied XFF header would let a caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing with $remote_addr (the unforgeable socket peer) keys the limiters on the true client. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	4 days ago
Thomas Joise	a7b3ade22e	chore(deploy): rename nginx vhost to sims.hq.conf + add paths/names reference One name end to end: deploy/nginx-hq.conf -> deploy/sims.hq.conf matching /etc/nginx/conf.d/sims.hq.conf. Add deploy/PATHS-AND-NAMES.md as the single production reference (paths, names, ports, everyday commands). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	4 days ago

Author

SHA1

Message

Date

Thomas Joise

1d715e6a64

fix(sec/d24): nginx sends X-Forwarded-For as $remote_addr (replace, not append)

With the app's trust-proxy=1, an appended client-supplied XFF header would let a
caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing
with $remote_addr (the unforgeable socket peer) keys the limiters on the true
client.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Thomas Joise

a7b3ade22e

chore(deploy): rename nginx vhost to sims.hq.conf + add paths/names reference

One name end to end: deploy/nginx-hq.conf -> deploy/sims.hq.conf matching /etc/nginx/conf.d/sims.hq.conf. Add deploy/PATHS-AND-NAMES.md as the single production reference (paths, names, ports, everyday commands).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 Commits (9ac2ce9d50c5631416f647650d257521c21b997a)