Answer stability round 1: 2 🔴, 3 🟡 (0 misread); refuse a trailing-slash range, full plugin route, merged tests, compose passes TRUSTED_PROXIES

2026-11-08 15:06:19 +01:00
parent 85219b081a
commit b19b43685c
10 changed files with 84 additions and 56 deletions
@@ -24,6 +24,7 @@ services:
      PLUGIN_DB_URL: ${PLUGIN_DB_URL:-}
      REQUIRE_SECURE_SECRETS: "true"
      SECURE_COOKIES: "true" # prod serves https — mark session/CSRF cookies Secure
+      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-} # IPs/CIDRs of your reverse proxy; empty ⇒ X-Forwarded-For is ignored
    # Wait for the services the app talks to (kratos + keto + hydra for the OAuth2 login/
    # consent handler) + the one-shot bootstrap (admin + JWKS seed). Postgres too: a plugin that
    # declares `storage` opens its connection in onBoot, before the server listens.