odoo/documentation#6744
Created by fw-bot
Statuses:
- ci/documentation: (runtime 109s)
- ci/codeowner_coverage: (runtime 9s)
- label
- odoo-dev:master-15.0-proxy_mode-juc-xfea-fw
- head
- ee679817275b44bf162d5ea9f67ee8ca32972a9a
- merged
- 2 years ago by SM Learn, Julien Castiaux (juc)
| odoo/documentation | |
|---|---|
| 15.0 | #6729 |
| saas-15.2 | #6737 |
| 16.0 | #6738 |
| saas-16.1 | #6739 |
| saas-16.2 | #6740 |
| saas-16.3 | #6741 |
| saas-16.4 | #6742 |
| 17.0 | #6743 |
| 18.0 | |
| saas-18.2 | |
| saas-18.3 | |
| saas-18.4 | |
| 19.0 | |
| saas-19.1 | |
| saas-19.2 | |
| master | #6744 |
[FW][IMP] developer/reference/cli: --proxy-mode
Many customers struggle with their web server configuration, notably regarding the --proxy-mode option and the way X-Forwarded-* HTTP request headers are interpreted within Odoo.
The --proxy-mode section has been updated to cover the most common misunderstandings and to give guidances on how to setup a web server.
Odoo always only takes the last entry of the X-Forwarded-* request header because there are situations where it is not possible to determine which last n-th entry to use. Employees might access their odoo database via the internal network: connecting directly to nginx, while customers might access the database via an additional proxy such as cloudflare. The real IP of employees would be the last inside the X-Forwarded-For chain, while the real IP of customers would be the second last entry inside the chain. It would be incorrect to always take the same nth last entry inside the chain. The cloudflare's own IP address must be discarded from the chain. Web servers usually feature a way to ignore trusted IP from the chain, a way so that the real IP of the user is always the last entry inside the chain. Odoo relies on such feature to be active and configured.
Prior discussions about X-Forwarded-For:
* odoo/odoo#104947
* odoo/odoo#118629
* odoo/odoo#139536
All X-Forwarded-* headers are ignored in case the X-Forwarded-Host header is missing (even with --proxy-mode). System admin might be tempted to not set this header and to set Host instead, this is broken as this a user-agent would be able to spoof X-Forwarded-Host and Odoo would use that instead of the correct Host.
Prior discussions about X-Forwarded-Host:
* odoo/odoo#63277
* odoo/odoo#70117
Forward-Port-Of: #6729