News for hackers. Stuff that matters.

A comment on Security flaws in an SSO plugin for Caddy. Parent comment

Re:Security flaws in an SSO plugin for Caddy by francislavoie on Tuesday February 13, 2024 @01:42AM (#39355202)
Caddy itself has built-in support for correctly & safely parsing XFF via the trusted_proxies global option https://caddyserver.com/docs/caddyfile/options#trusted-proxi... The plugin should use the parsed client IP produced by this, but the plugin was written before trusted_proxies existed in Caddy. (Not excusing the mistake, but there's an "easy" solution if someone wants to resolve it.)
[ Parent | on HN ]
Re:Security flaws in an SSO plugin for Caddy by yonixwm on Tuesday February 13, 2024 @01:45AM (#39355216)
Again why mention the plugin? Just use the main caddy option… plugins are ment to expand caddy not replace existing directives

unless i am missing something and the plugin overrides default behavior then of course it’s to blame

[ Parent | on HN ]