Allow declared trusted hosts to access settings surfaces
Allow a host declared in trustedHosts, or an equivalent explicit opt-in, to satisfy the web client's settings trust so settings pages work through authenticated reverse proxies and tunnels. This would avoid incorrectly restricting settings to loopback origins when remote access is already trusted.
Explore challenge
The problem
Allow a host declared in trustedHosts, or an equivalent explicit opt-in, to satisfy the web client's settings trust so settings pages work through authenticated reverse proxies and tunnels. This would avoid incorrectly restricting settings to loopback origins when remote access is already trusted.
Start with these discussions
- [BUG]: Host-backed settings (Settings > Models/General) are impossible behind any reverse proxy — isLoopback gate tests the hostname string only, with no deployment overridegithub · ▲4 · 4 comments
- Upstream request: let a declared trusted host satisfy the client's settings trustgithub · ▲1 · 0 comments