Skip to content

Commit

Permalink
Clarify secure scheme header warning in deploy doc
Browse files Browse the repository at this point in the history
Gunicorn doesn't restrict the X-Forwarded-For header, only the
scheme header.
  • Loading branch information
tilgovi committed Feb 4, 2014
1 parent f375f92 commit 0226b2c
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions docs/source/deploy.rst
Original file line number Diff line number Diff line change
Expand Up @@ -107,9 +107,9 @@ This is to prevent a malicious client from forging these headers::
When the Gunicorn host is completely firewalled from the external network such
that all connections come from a trusted proxy (e.g. Heroku) this value can
be set to '*'. Using this value is **potentially dangerous** if connections to
Gunicorn may come from outside the network as clients can use this header to
forge the IP address Gunicorn sees, circumventing application rate limits and
reporting incorrect addresses in log files.
Gunicorn may come from untrusted proxies or directly from clients since the
application may be tricked into serving SSL-only content over an insecure
connection.

Using Virtualenv
================
Expand Down

0 comments on commit 0226b2c

Please sign in to comment.