From 7e3707cf07c819475f61b3492b3a715198fa5d23 Mon Sep 17 00:00:00 2001 From: Christian Fehmer Date: Mon, 6 Jul 2026 18:49:45 +0200 Subject: [PATCH 1/2] docs: add security section to self hosting guide (@fehmer) --- docs/SELF_HOSTING.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/SELF_HOSTING.md b/docs/SELF_HOSTING.md index dea22c83821e..c8a7db634b9b 100644 --- a/docs/SELF_HOSTING.md +++ b/docs/SELF_HOSTING.md @@ -61,6 +61,30 @@ docker compose up -d --force-recreate > After updating your configuration and recreating the containers, clear your browser cache or perform a hard reload (Ctrl + F5) to make sure your browser isn't running an old cached version of the frontend. +## Security + +Do not expose the Monkeytype backend directly to the internet. Instead, place it behind a reverse proxy and configure the backend to only accept connections from the reverse proxy. + +The backend's built-in rate limiting is based on the authenticated user's `uid` or, for unauthenticated requests, the client's IP address. + +To determine the client's IP address, the backend checks the following sources in order: + +1. `CF-Connecting-IP` (when requests are proxied through Cloudflare) +2. `X-Forwarded-For` +3. The source IP address of the HTTP connection + +We recommend the following configuration: + +- If you are **not** using Cloudflare, remove any incoming `CF-Connecting-IP` header in your reverse proxy before forwarding requests. +- Configure your reverse proxy to set the `X-Forwarded-For` header to the client's IP address. +- Configure the backend to only accept connections from the reverse proxy to prevent clients from spoofing trusted headers. + + +Sources: +- [cloudflare documentation for cf-connecting-ip](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip) +- [handling headers in traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/headers) + + ## Account System By default, user sign-up and login are disabled. To enable this, you'll need to set up a Firebase project. From 4ed4f9edf2c016a04b02c5c2d205aff13c9fce6b Mon Sep 17 00:00:00 2001 From: Christian Fehmer Date: Mon, 6 Jul 2026 21:57:18 +0200 Subject: [PATCH 2/2] toc --- docs/SELF_HOSTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/SELF_HOSTING.md b/docs/SELF_HOSTING.md index c8a7db634b9b..191287299c5c 100644 --- a/docs/SELF_HOSTING.md +++ b/docs/SELF_HOSTING.md @@ -11,6 +11,7 @@ - [Prerequisites](#prerequisites) - [Quickstart](#quickstart) - [Hosting over the network (HTTPS)](#hosting-over-the-network-https) + - [Security](#security) - [Account System](#account-system) - [Setup Firebase](#setup-firebase) - [Update backend configuration](#update-backend-configuration)