Security Audit Fixes: Session fixation prevention, SameSite cookies, audit log redaction, backup integrity, Docker hardening, error sanitization, rate limiting, trusted proxies, and config hardening

backend/cmd/traefik-gui/main.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -28,6 +29,7 @@ func main() {
 		configDir      = flag.String("config-dir", "./configs/dynamic", "File provider config directory")
 		devMode        = flag.Bool("dev", false, "Development mode (serves frontend from Vite)")
 		adminPassword  = flag.String("admin-password", os.Getenv("GUI_ADMIN_PASSWORD"), "Admin password (env GUI_ADMIN_PASSWORD)")
+		trustedProxies = flag.String("trusted-proxies", os.Getenv("GUI_TRUSTED_PROXIES"), "Trusted proxy IPs for X-Forwarded-For (comma-separated)")
 		showVersion    = flag.Bool("version", false, "Show version and exit")
 	)
 
@@ -53,6 +55,14 @@ func main() {
 		log.Fatal("session-secret must be at least 32 characters")
 	}
 
+	if *trustedProxies == "" {
+		*trustedProxies = os.Getenv("GUI_TRUSTED_PROXIES")
+	}
+	if *trustedProxies == "" {
+		*trustedProxies = "*"
+	}
+	trustedList := strings.Split(*trustedProxies, ",")
+
 	cfg := &config.Config{
 		Addr:           *addr,
 		DBPath:         *dbPath,
@@ -61,6 +71,7 @@ func main() {
 		TraefikAPIURL:  *traefikAPIURL,
 		ConfigDir:      *configDir,
 		DevMode:        *devMode,
+		TrustedProxies: trustedList,
 	}
 
 	db, err := database.New(cfg.DBPath)