Ettore Di Giacinto 0cb1490a12 fix(http): believe X-Forwarded-Prefix only from a trusted proxy ...

StripPathPrefix and the redirect from / and /browse still read
X-Forwarded-Prefix from any peer, after BaseURL and BasePathPrefix
were gated on --trusted-proxies. A client could make the server strip
a path prefix or add one to a redirect.

Gate both on the same trusted-proxy resolver. The resolver is now
stamped into the request before StripPathPrefix runs, and the check is
exported as ForwardedHeadersTrusted. The explorer has no
--trusted-proxies option and keeps its old behavior by trusting every
peer for this one header. The docs say that the prefix needs a trusted
proxy.

Assisted-by: Claude:claude-sonnet-5-5 go-test

2026-11-03 21:50:57 +00:00

..

_index.en.md

docs: fix dead anchors and a dead section link (#11885)

2026-09-05 23:47:13 +02:00

advanced-usage.md

docs: point the config example link at the configurations directory

2026-09-27 19:06:33 +00:00

embedded-routing-log.md

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

model-configuration.md

feat(api): accept request-level chat_template_kwargs

2026-11-03 19:22:19 +00:00

private-sources.md

feat(gallery): galleries published as OCI artifacts (#12167)

2026-09-21 09:23:05 +02:00

reverse-proxy-tls.md

fix(http): believe X-Forwarded-Prefix only from a trusted proxy

2026-11-03 21:50:57 +00:00

vram-management.md

fix(distributed): exclude pinned models from cluster eviction and idle scale-down

2026-09-11 23:08:26 +00:00