Proxy warning - rejetto/hfs GitHub Wiki

If you got a message like this, you may be wondering why.

The problem

This warning is important because correct configuration of proxies is necessary for HFS to know the real IP of your visitors. If the IP is "wrong", some of options that you may have set in HFS may not work as they should, even causing security problems. For example, strangers may get access to your admin-panel, so please take this seriously.

The admin-panel example above is because (by default) HFS considers you the admin if you are accessing from the same computer (localhost), and it knows you are because of the address.

More

The warning above appears when a request was received carrying a "command" that only a legit proxy should set.

This should happen when people is reaching you through a proxy you should be aware of. If you are not totally sure, investigate. Even an nginx you have locally tunneling the traffic HFS gets, counts as proxy. When you are sure that this proxy is legit, only then you should configure HFS to accept it, by setting the number of proxies to 1, if 1 is the number of the proxies you have in front of HFS.

BUT, if you don't have any legit proxy that you know, then we can assume the request was forged to try to fool the server. This implies no harm, as HFS by default will ignore such command and you don't need to do anything. The warning is mostly there to help you handle the legit case, as only that case requires your intervention.

You can use the "ignore" button if you want to hide the warning.

The opposite problem

If instead of the above, you get this message

you are basically in an equivalent situation: be sure the number of proxies is correct, because otherwise HFS doesn't know the real IP of your visitors, with consequences described above.