interesting, this would mean taking the auth header and just going along with it. My feeling is that this should be rather easy to do (or there is already some package for this)

I remember a issue with this. So it would require the app to be changed as well, to allow using API key for logging in, instead of using username/password, as that would no longer work (they have no password).

My current nginx setup allows anyone to access /static, /media and /api, and that should still work with such a setup as this.

(have started adding the setting and the docs to the other repos)

grafana has an optional IP whitelist, might also be a good idea

grafana has an optional IP whitelist, might also be a good idea

Might be a good idea to support in the future, but isn't necessary for this, is it? :)

I just added it now, wasn't much work, seems more secure that way 😄

If you can, can you checkout the branch and check that it works it with a real auth service? I've just done some very rudimentary tests

Is the intention that you're forced to set AUTH_PROXY_TRUSTED_IPS? Because it's somewhat dubious what it actually protects from. I think many will be running it through nginx, where REMOTE_ADDR should always be 127.0.0.1, but that would STILL allow a malicious user to set the header, ie. no protection.

What it protects against, is if wger is bound to 0.0.0.0, and someone connects directly to it, around the reverse proxy.

E.g. I specifically set this in places, where I want to ensure the client cannot manipulate the headers. This is e.g. for the API endpoint, which shouldn't use that form of authentication, on mobile devices.

proxy_set_header Remote-User "";
proxy_set_header Remote-Groups "";
proxy_set_header Remote-Email "";
proxy_set_header Remote-Name "";

I'll try to test it out when I find the time :)

What it protects against, is if wger is bound to 0.0.0.0, and someone connects directly to it, around the reverse proxy.

exactly. In the docker setup the application and the proxy are different services and you only want to accept the headers from the one you want (ok, here you couldn't access the application directly from the outside, but with other setups, you might). I feel that explicitly whitelisting the auth proxy makes it clearer and avoids potentially leaving this open because you didn't think about something.

I'll try to test it out when I find the time :)

💪🏻