Ettore Di Giacinto 0cb1490a12 fix(http): believe X-Forwarded-Prefix only from a trusted proxy ...

StripPathPrefix and the redirect from / and /browse still read
X-Forwarded-Prefix from any peer, after BaseURL and BasePathPrefix
were gated on --trusted-proxies. A client could make the server strip
a path prefix or add one to a redirect.

Gate both on the same trusted-proxy resolver. The resolver is now
stamped into the request before StripPathPrefix runs, and the check is
exported as ForwardedHeadersTrusted. The explorer has no
--trusted-proxies option and keeps its old behavior by trusting every
peer for this one header. The docs say that the prefix needs a trusted
proxy.

Assisted-by: Claude:claude-sonnet-5-5 go-test

2026-11-03 21:50:57 +00:00

..

advanced

fix(http): believe X-Forwarded-Prefix only from a trusted proxy

2026-11-03 21:50:57 +00:00

development

feat(addons): declare typed host capabilities (#13034)

2026-11-02 23:50:40 +00:00

features

docs(addons): document host access in the UI

2026-11-03 21:45:05 +00:00

getting-started

test(addons): guard core against naming a shipped add-on

2026-11-03 15:38:07 +00:00

operations

docs(cloud-proxy): keep the OrcaRouter example neutral

2026-11-03 19:20:44 +00:00

reference

feat(connectors): grant the usual permissions once to old bindings

2026-11-03 21:17:39 +00:00

_index.md

feat(website): split the site, move docs to /docs, add a landing page (#11243)

2026-07-31 09:00:56 +02:00

faq.md

docs(faq): note OPENAI_BASE_URL env var for pointing clients at LocalAI (#11310)

2026-09-11 14:44:18 +02:00

integrations.md

docs: add Nika to Agentic Libraries & Assistants integrations

2026-11-03 19:20:44 +00:00

overview.md

feat(chats): server-side chats with steering, sub-agents and compaction (#12918)

2026-11-01 12:08:23 +01:00

whats-new.md

docs: point the News page at the blog instead of a stale highlights list

2026-08-03 20:29:50 +00:00