Ettore Di Giacinto 6cbee5181c fix(http): believe forwarded headers only from a trusted proxy ...

BaseURL and BasePathPrefix read X-Forwarded-Proto, X-Forwarded-Host,
X-Forwarded-Prefix and Forwarded from any caller when LOCALAI_BASE_URL
is not set. A client could pick the scheme and host that end up in the
SPA <base href>, generated links and redirects.

Gate them on the trusted-proxy resolver (--trusted-proxies): the headers
count only when the TCP peer is trusted. An empty list trusts nobody, so
the request's own scheme and host are used. LOCALAI_BASE_URL still wins
over everything for the origin.

This changes behavior for setups behind a proxy that rely on these
headers without setting LOCALAI_BASE_URL: they must now list the proxy
in --trusted-proxies. The docs say so.

Assisted-by: Claude:claude-sonnet-5-5 go-test

2026-11-03 19:38:36 +00:00

..

clientip_test.go

fix(http): believe forwarded headers only from a trusted proxy

2026-11-03 19:38:36 +00:00

clientip.go

fix(http): believe forwarded headers only from a trusted proxy

2026-11-03 19:38:36 +00:00