eaglercraft/eaglercraft-1.5
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
LAX1DUDE 2022-07-06 22:49:53 -07:00 committed by GitHub
parent f0fd21874e
commit fff039e79b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
README.md
View File

@ -148,7 +148,18 @@ origin_blacklist_simple_whitelist:
origin_blacklist_block_offline_download: true
```
**To use IP bans and rate limiting, enable** `forward_ip` **and pass a X-Real-IP header from your proxy to the bungeecord's websocket port**
### To stop people from using bookmarklets to load a client from a different URL onto your official URL via XXS, add these headers to NGINX:
```
add_header X-Frame-Options "SAMEORIGIN";
add_header Referrer-Policy "strict-origin";
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' data: blob:; connect-src 'self' ws: wss:; upgrade-insecure-requests";
```
(not fully tested, excuse the scroll bar)
### To use IP bans and rate limiting, enable `forward_ip` and pass a X-Real-IP header from your proxy to the bungeecord's websocket port
Nginx example: add `proxy_set_header X-Real-IP $remote_addr` to your proxy configuration