From 66de92fbb1b0bba84a4d417f3588aaaa250e9dc6 Mon Sep 17 00:00:00 2001 From: emeric Date: Thu, 27 May 2021 14:02:55 +0200 Subject: [PATCH] Added some security considerations --- INSTALL.md | 4 ++-- README.md | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/INSTALL.md b/INSTALL.md index 3a15efb6..63691737 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -173,9 +173,9 @@ server { location / { + proxy_set_header Client-IP $remote_addr; proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:5082/; diff --git a/README.md b/README.md index 1d8d524f..d9c9a8e5 100644 --- a/README.md +++ b/README.md @@ -77,6 +77,14 @@ $setmulti(albumartistssort,%_albumartists_sort%) * Previous track: Ctrl + Left * Next track: Ctrl + Right +## Security considerations +_Wt_ (the web framework used) has some [built-in security mesures](https://www.webtoolkit.eu/wt/features#security), but _LMS_ also has some too: +* to mitigate brute force login attempts, _LMS_ uses an internal login throttler based on the client IP address. The `Client-IP` or `X-Forwarded-For` headers are used to determined the real IP adress, so make sure to properly configure your reverse proxy to filter or even erase the values (see example in [INSTALL.md](INSTALL.md)). +* all passwords are stored hashed and salted using [bcrypt](https://fr.wikipedia.org/wiki/Bcrypt) +* all the resources relative to the music collection (tracks, covers, etc.) are private to a session + +## Keyboard shortcuts + ## Installation See [INSTALL.md](INSTALL.md) file.