Merge remote-tracking branch 'origin/master' into master

ezsystems · Oct 26, 2020 · 1b32796 · 1b32796
2 parents 31c6c46 + 51b7360
commit 1b32796
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/doc/docker/varnish.yml b/doc/docker/varnish.yml
@@ -9,7 +9,9 @@ services:
   app:
     environment:
      - APP_HTTP_CACHE=0
-     - TRUSTED_PROXIES=varnish
+     # Never do this in production if the app container is accesible for the public as well
+     # See https://ezplatform.com/security-advisories/ezsa-2020-002-unauthorised-cache-purge-with-misconfigured-fastly for more details how it could be abused
+     - TRUSTED_PROXIES=REMOTE_ADDR
      - HTTPCACHE_PURGE_SERVER=http://varnish
      - HTTPCACHE_PURGE_TYPE=varnish