Cloudron Forum

girish

The way it's implemented is that the white list is provided in the VPN UI but the VPN itself is optional. It's also not implemented at a per-app level but at a system level just like the current VPN protection.

AFAIU, these IPs are primarily maybe intranet addresses. So, it's a way to say that these IP addresses don't need any protection.

girish

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

girish

Thanks for reporting. I pushed an update to fix this.

girish

I have fixed this now. Thanks for reporting @nostrdev

girish

This is fixed now .

girish

@huehner Good catch, fixed now.

luckow

App package bug?

Similar behaviour on all instances.

Ghost app package: org.ghost.cloudronapp2@4.205.1

Oct 28 17:39:15 [2026-10-28 16:39:15] ERROR "POST /members/api/send-magic-link/" 400 3ms
Oct 28 17:39:15 
Oct 28 17:39:15 The request could not be understood.
Oct 28 17:39:15 2026-10-28T17:39:15+01:00 
Oct 28 17:39:15 Error ID:
Oct 28 17:39:15 7b4bd747-39c6-2sed-9873-45b34343cb09
Oct 28 17:39:15 2026-10-28T17:39:15+01:00 
Oct 28 17:39:15 ----------------------------------------
Oct 28 17:39:15 2026-10-28T17:39:15+01:00 
Oct 28 17:39:15 BadRequestError: The request could not be understood.
Oct 28 17:39:15 at verifyIntegrityToken (/home/cloudron/ghost/versions/6.72.0/core/server/services/members/middleware.js:332:15)
Oct 28 17:39:15 at Layer.handle [as handle_request] (/home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/express@4.22.3_supports-color@10.2.2/node_modules/express/lib/router/layer.js:95:5)
Oct 28 17:39:15 at next (/home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/express@4.22.3_supports-color@10.2.2/node_modules/express/lib/router/route.js:149:13)
Oct 28 17:39:15 at /home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/body-parser@1.20.8_supports-color@10.2.2/node_modules/body-parser/lib/read.js:137:5
Oct 28 17:39:15 at AsyncResource.runInAsyncScope (node:async_hooks:227:14)
Oct 28 17:39:15 at invokeCallback (/home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/raw-body@2.5.3/node_modules/raw-body/index.js:238:16)
Oct 28 17:39:15 at done (/home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/raw-body@2.5.3/node_modules/raw-body/index.js:227:7)
Oct 28 17:39:15 at IncomingMessage.onEnd (/home/cloudron/ghost/versions/6.72.0/node_modules/.pnpm/raw-body@2.5.3/node_modules/raw-body/index.js:287:7)
Oct 28 17:39:15 at IncomingMessage.emit (node:events:514:28)
Oct 28 17:39:15 at endReadableNT (node:internal/streams/readable:1783:12)
Oct 28 17:39:15 at process.processTicksAndRejections (node:internal/process/task_queues:90:21)

girish

I have fixed this now. There is now a new flag in the manifest called streamRequestBody which will help packages to disable request buffering. By default, the platform also now caps request bodies to 100M. Packages that want more have to enable this flag and also make sure they can deal with slowloris style DoS attacks.

girish

This is a good request @timka . I started investigating this and this led me down to quite some rabbit hole. Will fix

girish

@sdeinfo OIDC Implicit flow has been deprecated for a while now and should not be used in new applications - https://oauth.net/2/grant-types/implicit/ . In fact, in the over 200 packages we maintain only one app uses implicit flow. Yup, guacamole. I very reluctantly added a hack in the manifest to get that package working.

I found that a fix is being worked on upstream - https://github.com/apache/guacamole-client/pull/1219 . You can also try https://github.com/Gerry9000/guacamole-auth-sso-oauth2 which fixes this exact issue . We will be moving to that repo shortly if upstream doesn't fix it soonish.

Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.

Cloudron Forum

Partner

Posts

Member List