fix: Remote access restrictions not enforced when running behind a reverse proxy by mtrezza · Pull Request #3436 · parse-community/parse-dashboard

mtrezza · 2026-08-11T11:19:24Z

Issue

The check that decides whether a request comes from localhost reads the TCP peer address, so a reverse proxy running on the same host makes every request it relays look local. The requirement that users be configured for remote access is gated on that check and was therefore not enforced behind such a proxy.

Approach

Split the two decisions that were sharing one check. Whether the connection needs encrypting stays keyed on the socket peer, since a loopback connection cannot be observed off the host. Whether a client may be granted access is now keyed on evidence that the request was relayed: any X-Forwarded-*, X-Real-IP or Forwarded header, or a configured trustProxy, means the request is not local.

The forwarded client address is deliberately not trusted as a substitute, because with trust proxy enabled Express derives it from client-supplied headers.

Tasks

Add tests

Summary by CodeRabbit

Bug Fixes
- Improved local-access detection so proxied remote requests aren’t treated as localhost.
- Prevented sensitive configuration access through forwarded requests.
- Preserved access for genuine localhost connections, including supported loopback addresses.
- Applied HTTPS enforcement consistently to remote connections.
- Restricted agent endpoints from unauthorized proxied access.
Tests
- Added coverage for proxy headers, trusted-proxy HTTPS requests, loopback access, and agent endpoint protection.

parse-github-assistant · 2026-08-11T11:19:27Z

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
Group code into logical blocks. Add a short comment before each block to explain its purpose.
We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

coderabbitai · 2026-08-11T11:19:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f5ee57d5-d7fa-4552-9599-c1e9fa6133cd

📥 Commits

Reviewing files that changed from the base of the PR and between 891fb0e and 2e51f56.

📒 Files selected for processing (2)

Parse-Dashboard/app.js
src/lib/tests/RemoteAccess.test.js

🚧 Files skipped from review as they are similar to previous changes (1)

Parse-Dashboard/app.js

📝 Walkthrough

Walkthrough

Local request detection now rejects configured proxies and forwarding headers. Remote-access checks separate connection HTTPS enforcement from strict local authentication. Tests cover dashboard and agent endpoints.

Changes

Remote access security

Layer / File(s)	Summary
Proxy-aware locality detection `Parse-Dashboard/app.js`	`isLocalRequest` rejects configured proxies and forwarding headers before checking `req.socket.remoteAddress`. HTTPS and authentication checks use separate locality rules.
Remote access validation `src/lib/tests/RemoteAccess.test.js`	Tests cover forwarded headers, trusted-proxy HTTPS behavior, genuine loopback access, master-key protection, configured-user access, peer-address handling, and agent endpoint rejection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required `fix:` prefix, uses capitalization correctly, and clearly describes the proxy-related access restriction fix.
Description check	✅ Passed	The description includes the issue, approach, and completed test task, and it directly explains the changes.
Docstring Coverage	✅ Passed	Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	The diff separates loopback transport checks from client locality, rejects forwarded or trusted-proxy requests without users, and adds master-key exposure tests; no new security bypass pattern is e...
Engage In Review Feedback	✅ Passed	The review thread records the author reproducing and addressing CodeRabbit feedback in `cae50af`; CodeRabbit confirmed the fix, and commit `2e51f56` adds the requested 127/8 handling and regression tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Parse-Dashboard/app.js`:
- Around line 90-109: Update the forwarding-header detection in isLocalRequest
to reject every x-forwarded-* header, including X-Forwarded-Proto and
X-Forwarded-Port, rather than relying only on the current explicit list. Add
coverage for a request containing only X-Forwarded-Proto and verify it cannot
receive the unauthenticated master-key response.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3bdff889-c74c-4655-9436-96199ba01a11

📥 Commits

Reviewing files that changed from the base of the PR and between 1948f96 and 2127fd8.

📒 Files selected for processing (2)

Parse-Dashboard/app.js
src/lib/tests/RemoteAccess.test.js

mtrezza · 2026-08-11T13:24:30Z

@coderabbitai full review

coderabbitai · 2026-08-11T13:24:36Z

✅ Action performed

Full review finished.

mtrezza · 2026-08-11T13:40:10Z

@coderabbitai review your feedback conversations and resolve where you found a consensus

coderabbitai · 2026-08-11T13:40:34Z

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="parse-community/parse-dashboard"
pr="3436"

echo "== Review threads =="
gh api graphql \
  -F owner="${repo%%/*}" \
  -F name="${repo#*/}" \
  -F number="$pr" \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          id
          isResolved
          isOutdated
          path
          line
          originalLine
          comments(first: 100) {
            nodes {
              id
              body
              createdAt
              author { login }
            }
          }
        }
      }
    }
  }
}' \
  --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
    {
      id, isResolved, isOutdated, path, line, originalLine,
      comments: [.comments.nodes[] | {author: .author.login, createdAt, body}]
    }'

echo
echo "== Top-level PR comments =="
gh api "repos/$repo/issues/$pr/comments?per_page=100" \
  --jq '.[] | {id, created_at, user: .user.login, body}'

Length of output: 16722

@mtrezza I reviewed the feedback conversations.

The only CodeRabbit review thread has a confirmed fix and is already resolved. No unresolved consensus threads remain on PR #3436.

_{You are interacting with an AI system.}

Addressed in cae50af: the locality check now rejects every x-forwarded-* header, with regression tests covering X-Forwarded-Proto and X-Forwarded-Port. CodeRabbit re-reviewed and subsequently ran a full review, both reporting no actionable comments.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Parse-Dashboard/app.js`:
- Around line 105-110: Update isLoopbackPeer to recognize every address in the
127.0.0.0/8 range, including IPv4-mapped representations, while retaining ::1
support. Add coverage verifying a non-127.0.0.1 address such as 127.0.0.2 is
treated as loopback.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a1141341-6cae-4d0b-9895-50460b7bd933

📥 Commits

Reviewing files that changed from the base of the PR and between cae50af and 891fb0e.

📒 Files selected for processing (2)

Parse-Dashboard/app.js
src/lib/tests/RemoteAccess.test.js

# [9.3.0-alpha.5](9.3.0-alpha.4...9.3.0-alpha.5) (2026-08-11) ### Bug Fixes * Remote access restrictions not enforced when running behind a reverse proxy ([#3436](#3436)) ([60cb379](60cb379))

parseplatformorg · 2026-08-11T22:26:23Z

🎉 This change has been released in version 9.3.0-alpha.5

fix: GHSA-cxmc-9pr8-fpqc

2127fd8

coderabbitai Bot previously requested changes Aug 11, 2026

View reviewed changes

Comment thread Parse-Dashboard/app.js

fix: Reject all x-forwarded-* headers in locality check

cae50af

fix: Keep the HTTPS requirement keyed on the connection

891fb0e

mtrezza changed the title ~~fix: GHSA-cxmc-9pr8-fpqc~~ fix: Remote access restrictions not enforced when running behind a reverse proxy Aug 11, 2026

coderabbitai Bot requested changes Aug 11, 2026

View reviewed changes

Comment thread Parse-Dashboard/app.js

fix: Recognize the full 127.0.0.0/8 loopback range

2e51f56

coderabbitai Bot approved these changes Aug 11, 2026

View reviewed changes

mtrezza merged commit 60cb379 into parse-community:alpha Aug 11, 2026
11 checks passed

mtrezza deleted the fix/GHSA-cxmc-9pr8-fpqc-v9 branch August 11, 2026 22:23

parseplatformorg added the state:released-alpha Released as alpha version label Aug 11, 2026

Navigation Menu

Repository navigation

fix: Remote access restrictions not enforced when running behind a reverse proxy - #3436

fix: Remote access restrictions not enforced when running behind a reverse proxy#3436
mtrezza merged 4 commits into
parse-community:alphafrom
mtrezza:fix/GHSA-cxmc-9pr8-fpqc-v9

mtrezza commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

parse-github-assistant Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

mtrezza commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

mtrezza commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

parseplatformorg commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mtrezza commented Aug 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Approach

Tasks

Summary by CodeRabbit

Uh oh!

parse-github-assistant Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mtrezza commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrezza commented Aug 11, 2026

Uh oh!

coderabbitai Bot commented Aug 11, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

parseplatformorg commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtrezza commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading