c-bless / reveal

This project contains some PowerShell scripts used to collect system configurations or domain information. Furthermore it has a Flask based web application and API to import and analyze the results of collector scripts. It can export collected data to Excel via the Web-Interface or to JSON via API.
1 stars 1 forks source link

Fix reveal to work on other ports than 443 #100

Closed Kavakuo closed 4 days ago

Kavakuo commented 5 days ago

Strict Referrer checks are disabled. In the docker setup the requests are reverse proxied through the nginx container. If the port mapping in the docker-compose file is changed, e.g. 8443:443, the Browser will send [Host]:8443 in the Referrer-Header. Because of the reverse-proxy, the request is received by the webapp container on port 443. Since both does not match, an error message is triggered by the csrf extension. https://github.com/wtforms/flask-wtf/blob/main/src/flask_wtf/csrf.py#L273

See also: https://pythonhosted.org/Flask-WTF/config.html