Sign in Talk to us Free trial
Free trial

Design and software studio
Colour

Public address and trusted proxies

Set the web address customers use for tracking links, and list the proxies whose forwarded addresses the server may believe.

For
OwnerAdministrator
Hosting
Office serverYour own hostingHosted plan
Devices
Server
Business
All businesses

Checked against Pop Dispatch 0.1.0

Two settings decide how customers reach your server and how the server sees their addresses. You will be able to set the public base address, and list the proxies in front of your server.

Before you start #

  • The public base address needs an owner or manager sign-in.
  • The trusted proxy list is an environment value on the server, so whoever starts the server sets it. See "Hosting the office server".

Set the public base address #

  1. Decide the address customers will type, such as https://dispatch.example.com. It starts with https, names the host only and has no path, query or sign-in details.
  2. Send it with PATCH /settings/public and the field public_base_url. Plain http is accepted for localhost only.
  3. Read it back with GET /settings/public. Anyone signed in can read it.
  4. To clear it, send an empty value.
  5. Open a tow call. Its tracking link now starts with your address. See "The customer tracking link".

List the trusted proxies #

  1. Find the address or network of each proxy in front of the server, such as 10.0.0.5 or 10.0.0.0/8.
  2. Set PSD_TRUSTED_PROXIES to the list, separated by commas, spaces or semicolons.
  3. Restart the server. It then reads the customer's address from X-Forwarded-For, past each trusted proxy.
  4. Leave the list empty when no proxy sits in front. Every caller then counts by the address the server sees.

Why the proxy list matters #

Rate limits and the sign-in lockout count requests by address. Behind a proxy that you leave unlisted, every caller shares the proxy's address and shares one limit. With the proxy listed, each customer counts alone. A header from an address outside the list is ignored, so nobody can claim another address.

Technical details
  • public_base_url is at most 200 characters. A change writes "changed the public base address" to the audit log.
  • Errors: validation_failed (422) with fields: ["public_base_url"] for a value that breaks the rules above.
  • An entry in PSD_TRUSTED_PROXIES that is neither an address nor a network stops the server at start and names the entry.
  • Neither setting has a field in the console yet.

If something goes wrong #

  • 422 on public_base_url: use https:// and a bare host name.
  • 403 on the change: your role is neither owner nor manager.
  • The server stops at start with a message naming a proxy entry: correct that entry.
  • Every customer hits the rate limit together: list the proxy.