From 115efa0e498655e7214b2269fdb232e42a73e08e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 16:25:14 +0000 Subject: [PATCH] docs(authentication): say Setup shows the address the server judges before an allowed IP ranges save The "Saving, clearing and lockout recovery" list now names the note under the Allowed IP ranges field: the address the server judges for the request, read from GET /api/v1/auth/admin/client-address (platform administrators only), whether forwarded headers counted, and the no-address case. Co-authored-by: Claude Claude-Session: https://claude.ai/code/session_01Utp6CZhiLoN3MZGp7ZnqCg --- content/docs/permissions/authentication.mdx | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/docs/permissions/authentication.mdx b/content/docs/permissions/authentication.mdx index 97b324a1d06..95d5fd53fd2 100644 --- a/content/docs/permissions/authentication.mdx +++ b/content/docs/permissions/authentication.mdx @@ -669,6 +669,14 @@ These rules apply to `allowed_ip_ranges`. because the gate would refuse you too. Only a change is checked: saving the list already in force again is not refused. Writes made inside the server (boot, seed, migrations) carry no request and are not checked. +- **Setup shows your address before you save.** Under the field, **Setup → + Authentication** shows the address the server judges for your request, read from + `GET /api/v1/auth/admin/client-address` (platform administrators only), which + answers `{ clientAddress, trustProxy }`: the note says whether that address came + from the forwarded headers of a proxy the server trusts (`server.trustProxy`) or + from the connection itself, which behind a proxy it does not trust is the proxy's + own address, and when `clientAddress` is `null` it says instead that no non-empty + list can be saved. - **Clearing takes effect at once.** Empty the field and save. No restart is needed: the gate goes back to the list the deployment itself declares (`allowedIpRanges` in its auth configuration, for example set by an `auth:configure` handler), or to no