From c83fe1b2c4eabe0765430b8e78e362247f0be37e Mon Sep 17 00:00:00 2001 From: unsupportedpastels Date: Mon, 5 Oct 2026 14:16:06 +0000 Subject: [PATCH] docs(dashboard): name what an untrusted proxy means for login limits --- website/docs/user-guide/features/web-dashboard.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/website/docs/user-guide/features/web-dashboard.md b/website/docs/user-guide/features/web-dashboard.md index a7cd53a100..99727e86e2 100644 --- a/website/docs/user-guide/features/web-dashboard.md +++ b/website/docs/user-guide/features/web-dashboard.md @@ -1000,7 +1000,9 @@ Only listed peers may supply `X-Forwarded-Proto` and `X-Forwarded-For`. Hermes always preserves loopback trust and rejects `*`, `0.0.0.0/0`, and `::/0`. Trusting a network means every container or machine on that network can supply forwarding metadata, so prefer an exact proxy IP or a dedicated -proxy-only network. +proxy-only network. Without a trusted-proxy entry, clients behind that proxy +share its password-login rate limit and native sign-in cap, and auth audit +events record the proxy's address. ```bash # Backend remains reachable only on this machine.