I missed documenting this change, but prior to 4.27.0 the query param was never considered when matching resources. But that's no longer the case.
Fixes#1817
* Document X-Forwarded-For capabilities within access-control networks
Adds a short paragraph detailing X-Forwarded-For header behaviour
into the documentation.
* Update docs/configuration/access-control.md
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
* Clarify use of multiple subjects and their logical evaluation
* Update docs/configuration/access-control.md
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
* it doesn't work with our current CSP
* it's probably not used by anyone
* it isn't in harmony with our security purposes
* literally removes all use of it
* suggestions from code review
* remove useless test.
Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
Co-authored-by: Clement Michaud <clement.michaud34@gmail.com>
* added support for listing multiple domains and multiple subjects
* updated documentation to show use of multiple domains and subjects
* updated config.template.yml to display multiple domains as a list
* updated config.template.yml to display multiple subjects as a list
* updated docs/configuration/access-control.md to display multiple domains as a list
* updated docs/configuration/access-control.md to display multiple subjects as a list
* removed redundant check that always returned true
* Commentary definition for `weak`
James Elliott
David Chidell
Amir Zarrinkafsh
Clément Michaud
Lukas Klass
Philipp Staiger
Dustin Sweigart