diff --git a/.env b/.env index 557ed6e8..c175012b 100644 --- a/.env +++ b/.env @@ -8,6 +8,7 @@ APP_SECRET=a03498528f5a5fc089273ec9ae5b2849 # Change this and uncomment the following line to set the trusted hosts for your Part-DB installation, aka under which # domain names it is reachable. This is makes things more secure, because it can prevent certain header attacks. # You have to escape dots in the domain name with a backslash +# IMPORTANT: In .env files (like this one), the value must be wrapped in single quotes as shown below. #TRUSTED_HOSTS='^(your-domain\.invalid)$' # You can also allow multiple domain names, e.g. for testing or development purposes, with an | between the domain names. diff --git a/docs/configuration.md b/docs/configuration.md index 6bf59529..d6309351 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -265,10 +265,16 @@ See the [information providers]({% link usage/information_provider_system.md %}) should be accessible. If accessed via a hostname not matching the regex, an error page will be shown instead. By default this is empty, meaning Part-DB accepts requests for any host name, which is not recommended for production use. - For example, if Part-DB should only be reachable under `part-db.example.invalid`, set: + For example, if Part-DB should only be reachable under `part-db.example.invalid`, set the following in your + `.env.local` file (the value must be wrapped in single quotes here): ``` TRUSTED_HOSTS='^(part-db\.example\.invalid)$' ``` + If you set `TRUSTED_HOSTS` as an environment variable in your `docker-compose.yaml` instead, the value must + **not** be quoted: + ``` + TRUSTED_HOSTS=^(part-db\.example\.invalid)$ + ``` You can specify multiple host names separated by `|`, e.g. `^(localhost|part-db\.example\.invalid)$`. Part-DB displays a warning on the homepage (visible to administrators only) as long as this value is not set. * `DEMO_MODE` (env only): Set Part-DB into demo mode, which forbids users to change their passwords and settings. Used for the demo diff --git a/docs/installation/installation_docker.md b/docs/installation/installation_docker.md index 0d5f8a8b..1331f2a3 100644 --- a/docs/installation/installation_docker.md +++ b/docs/installation/installation_docker.md @@ -87,6 +87,7 @@ services: # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under. # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use. + # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes. # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$ # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here: @@ -101,7 +102,8 @@ services: openssl rand -hex 32 ``` 6. Uncomment and set the `TRUSTED_HOSTS` variable to a regex matching the host name(s) Part-DB should be reachable under - (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. See [Configuration]({% link configuration.md %}) + (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. Note that, unlike in `.env` files, the + value must **not** be quoted in `docker-compose.yaml`. See [Configuration]({% link configuration.md %}) for more information. 7. Inside the folder, run @@ -181,6 +183,7 @@ services: # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under. # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use. + # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes. # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$ # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here: diff --git a/docs/installation/reverse-proxy.md b/docs/installation/reverse-proxy.md index 24d502b4..30c74223 100644 --- a/docs/installation/reverse-proxy.md +++ b/docs/installation/reverse-proxy.md @@ -24,12 +24,18 @@ the reverse proxy). You should also set the `TRUSTED_HOSTS` environment variable to a regex matching the host name(s) Part-DB is reachable under via the reverse proxy, to prevent `HTTP Host header attacks`. For example, if Part-DB is reachable via -`part-db.example.invalid`, set: +`part-db.example.invalid`, set the following in your `.env.local` file (the value must be wrapped in single quotes here): ``` TRUSTED_HOSTS='^(part-db\.example\.invalid)$' ``` +If you set `TRUSTED_HOSTS` in your `docker-compose.yaml` instead, the value must **not** be quoted: + +``` +TRUSTED_HOSTS=^(part-db\.example\.invalid)$ +``` + See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`. ## Part-DB in a subpath via reverse proxy diff --git a/templates/bundles/TwigBundle/Exception/error400.html.twig b/templates/bundles/TwigBundle/Exception/error400.html.twig index f5ed56b9..2ad31626 100644 --- a/templates/bundles/TwigBundle/Exception/error400.html.twig +++ b/templates/bundles/TwigBundle/Exception/error400.html.twig @@ -23,12 +23,16 @@

Try following things: