-
feat(security): allow LAN access over HTTP without HTTPS requirement (#1336)
frostbyte_neo 发布于
2025-12-08 16:56:24 +00:00 Trust RFC 1918 private IPs (192.168.x.x, 10.x.x.x, 172.16-31.x.x) the same
as localhost for cookie security. This allows users to access LDR from any
device on their local network without needing HTTPS.This matches the behavior of other self-hosted applications like Jellyfin
and Home Assistant, which consider LAN traffic trusted for personal use.Security model:
- Private network HTTP (localhost, LAN IPs): Works without Secure flag
- Public IP HTTP: Blocked (requires HTTPS)
- Behind proxy: Blocked (requires HTTPS)
- TESTING mode: Works (for CI/development)
Changes:
- Add _is_private_ip() helper using Python's ipaddress module
- Update SecureCookieMiddleware to trust private IPs
- Update CSRF error message to reflect LAN access works
- Add tests for LAN IP cookie security
下载附件