6 commits

Author	SHA1	Message	Date
Philipp Mundhenk	863f719da3	proxy-auth: remove check_proxy / proxy_ip settings ... The "Check Proxy" option inspected the forwarded client IP returned by Http::GetClientIp(true), which resolves to HTTP_X_FORWARDED_FOR first and only falls back to REMOTE_ADDR. In any typical reverse-proxy deployment that header carries the end-user's IP, not the proxy's, so the option never actually validated that the request came from the trusted proxy. It only constrained the set of end-user IPs allowed to use SSO, which is not a meaningful guarantee on its own. Drop the option, the paired proxy_ip subnet field, and the ip_in_range helper. Document that access must be gated at the network layer (firewall / docker network / bound interface) and that the upstream proxy must strip any client-supplied value of the configured remote-user header. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-17 10:44:36 +02:00
Philipp Mundhenk	68588287ef	proxy-auth: document APP_SALT rotation troubleshooting ... Add README note explaining that AUTHENTICATIONFAILED after a container rebuild or data reset is typically caused by an APP_SALT change invalidating the encrypted master credentials, and that re-entering them in the admin UI restores access. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-17 09:57:22 +02:00
Philipp Mundhenk	a9b89fd7b3	Update instructions for Dovecot 2.4	2025-06-07 13:06:23 +02:00
Philipp Mundhenk	b947db2eb1	added documentation for usage of custom_logout_link	2024-01-21 15:31:32 +01:00
Philipp Mundhenk	59c0f5cc94	documented auto login, improved security documentation	2024-01-21 15:09:31 +01:00
Philipp Mundhenk	f6eab84d40	added README	2024-01-14 18:22:59 +01:00