mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-09-22 17:44:00 +02:00
556eca95d3
Reported from a remote session: ingress answered `403 External internet access denied - https://sabnzbd.org/access-denied`. Root cause is `check_access()` in `sabnzbd/interface.py`: # Never check the XFF header unless access would have been granted # based on the remote IP alone! if is_allowed and cfg.verify_xff_header() and (xff_ips := ...): is_allowed = all(is_local_addr(ip) or is_loopback_addr(ip) for ip in xff_ips) nginx's own address is loopback, so the first test passes, and then every address in X-Forwarded-For has to be local too. Supervisor puts the browser's address in that header, so anyone reaching Home Assistant from outside the LAN is refused. `verify_xff_header` defaults to on (`cfg.py:531`), so this is not a configuration a user opted into. Reproduced against the running add-on, `GET /config/general/`: no X-Forwarded-For 200 X-Forwarded-For: 81.164.12.7 403 External internet access denied X-Forwarded-For: 81.164.12.7, 172.30.32.2 403 X-Forwarded-For: 192.168.1.44 200 which is why it worked on the LAN and not from outside. Verified the fix the same way, running the shipped nginx.conf and ingress.conf in front of the live add-on with both variants side by side: the current config 403s on a public address, the fixed one answers 200 for all three chains, and redirects, static roots and the API are unaffected. That instance has an empty `url_base`, so the pass-through routing is now confirmed for both `url_base` values. The header was forwarded because SABnzbd reads it — the wrong test, since what it does with it is reject. Clearing it leaves SABnzbd looking at nginx's loopback address, which is what it saw before the header was added; ingress is gated by Home Assistant authentication before reaching this proxy either way. The evidence.md entry records the methodology error, per the skill's own feed-the-skill rule. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>