github/sub2api
4
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-30 00:21:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4462 from Wei-Shaw/fix/unify-security-client-ip

Browse Source 
fix(security): unify audit log & session binding client IP with API key ACL trust toggle
This commit is contained in:
Wesley Liddick
2026-07-17 09:42:43 +08:00
committed by GitHub
parent 1c3f2810af 7c48f9a85f
commit 2a75d7d238
11 changed files with 188 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/i18n/locales/en/admin/settings.ts
+3 -2
View File
@@ -146,10 +146,11 @@ export default {
},
apiKeyAcl: {
title: 'API Key IP Access Control',
description: 'Choose which client IP is used by API Key allowlists and denylists',
description:
'Choose which client IP is used by API Key allowlists/denylists, admin audit logs, and session IP/UA binding',
trustForwardedIp: 'Trust forwarded client IP',
trustForwardedIpHint:
'Disabled by default. Enable only when the origin is reachable only through Cloudflare or Nginx reverse proxy. When enabled, API Key IP allowlists and denylists use CF-Connecting-IP, X-Real-IP, or X-Forwarded-For, matching the request IP shown in usage records.'
'Disabled by default. Enable only when the origin is reachable only through Cloudflare or Nginx reverse proxy. When enabled, API Key IP allowlists/denylists, admin audit logs, and session IP/UA binding use CF-Connecting-IP, X-Real-IP, or X-Forwarded-For, matching the request IP shown in usage records. Toggling this switch changes the IP fingerprint of existing sessions; with session binding enabled they must sign in again.'
},
linuxdo: {
title: 'LinuxDo Connect Login',
frontend/src/i18n/locales/zh/admin/settings.ts
+2 -2
View File
@@ -146,10 +146,10 @@ export default {
},
apiKeyAcl: {
title: 'API Key IP 访问控制',
description: '控制 API Key 白名单和黑名单使用哪个客户端 IP 判断',
description: '控制 API Key 白/黑名单、操作审计日志与会话 IP/UA 绑定使用哪个客户端 IP 判断',
trustForwardedIp: '信任反代传递的客户端 IP',
trustForwardedIpHint:
'默认关闭。仅在源站只允许 Cloudflare 或 Nginx 反代访问时开启；开启后 API Key IP 白/黑名单会使用 CF-Connecting-IP、X-Real-IP 或 X-Forwarded-For，与使用记录中的请求 IP 保持一致。'
'默认关闭。仅在源站只允许 Cloudflare 或 Nginx 反代访问时开启；开启后 API Key IP 白/黑名单、操作审计日志与会话 IP/UA 绑定会使用 CF-Connecting-IP、X-Real-IP 或 X-Forwarded-For，与使用记录中的请求 IP 保持一致。切换本开关会改变已登录会话的 IP 指纹，开启会话绑定时现有会话需重新登录。'
},
linuxdo: {
title: 'LinuxDo Connect 登录',