How to setup copyparty config behind istio and cloudflared ?

[vincentzhangz]

I want to know which config do I need to add for configuring the copy party works behind istio and cloudflared, because when I want to login to the admin I got

rejected by cors-check
URL: 

any help ?

[9001]

please check the copyparty server log; there should be an explanation there

[LetrixZ]

For me it complaints about chrome-extension:// protocol

cors-reject PROPFIND because request-header Origin='chrome-extension://extension_id' does not match request-protocol 'https://' and host '10.0.0.50:3923' based on request-header Host='10.0.0.50:3923' (note: if this request is not malicious, check if your reverse-proxy is accidentally modifying request headers, in particular 'Origin', for example by running copyparty with --ihead='*' to show all request headers)

I already enabled ihead under [global]

[9001]

@LetrixZ please create a new discussion since your issue is not the same as OP's issue; it will just become confusing if we discuss multiple different issues in one topic

[Lite5h4dow]

Yeah im having the same issue with nothing in the logs.

[Lite5h4dow]

Yeah I got rid of the error by switching to rproxy -1, but I keep getting the kubernetes cluster internal IP as the source IP, and there is only 1 IP in the array from what I can see (kubernetes + traefik)

[9001]

if you're not seeing the message in the log then something is up with how you've configured logging in your kubernetes cluster and that is the first thing you should look into fixing, because that probably means you are also missing out on other messages as well -- there definitely is a message there; in the latest version (released just now) it was extended to give as much relevant information as possible to help you fix the reverseproxy config:

previous versions had a less extensive message, but it was still there.

for the sake of your own security, please do not blindly set rproxy: -1 in your config before you have fixed the reverseproxy config, because this is how you tell copyparty that "everything is good to go now", and copyparty will trust you on that -- and since you're saying that you're still getting the kubernetes internal IP then that means you still have issues further up in your stack which you'll need to fix first

[Lite5h4dow]

if you're not seeing the message in the log then something is up with how you've configured logging in your kubernetes cluster and that is the first thing you should look into fixing, because that probably means you are also missing out on other messages as well -- there definitely is a message there; in the latest version (released just now) it was extended to give as much relevant information as possible to help you fix the reverseproxy config:

previous versions had a less extensive message, but it was still there.

for the sake of your own security, please do not blindly set rproxy: -1 in your config before you have fixed the reverseproxy config, because this is how you tell copyparty that "everything is good to go now", and copyparty will trust you on that -- and since you're saying that you're still getting the kubernetes internal IP then that means you still have issues further up in your stack which you'll need to fix first

Yeah I definitely don't have xf-host or xf-proxy, I didn't see them in this versions message or in the reverse proxy example for traefik

[o10s]

Same issue as OP @9001 only since this latest release

[9001]

you are not having the same issue, just the same symptom -- there are many, MANY things which can make this can happen, and the solution to your specific situation will be in the serverlogs, which is why the message is telling you to look there, so please do that

[9001]

the latest release (v1.19.23), released just now (2025-12-17) has further extended the message in the serverlog in the hope that it will help you fix the issue with your reverseproxy-related configuration which is causing this

[o10s]

Hello @9001 Thanks for taking the time to answer and do another version to have more details

As for the latest version I have indeed more feedback in the logs:

12:43:30.743 10.42.0.245 36518      LOG: GET  /?h @*
12:43:30.789 10.42.0.245 36518     WARN: could not determine the client's IP-address because the global-option --rproxy has not been configured, so the request-header [x-forwarded-for] specified by global-option --xff-hdr cannot be used safely! The raw header value was [10.42.0.1]. Please see the "reverse-proxy" section in the readme. The best approach is to configure your reverse-proxy to give copyparty the exact IP-address to assume (perhaps in another header), but you may also try the following:
  rproxy: -1   if this client's IP-address is [10.42.0.1]
Furthermore, the following request-headers are also relevant, and you should check that the values below are sensible:
  request-header [x-forwarded-proto] (configured with global-option --xf-proto) has the value [https]; this should be the protocol that the webbrowser is using, so either 'http' or 'https'
  request-header [x-forwarded-host] (configured with global-option --xf-host) has the value [copyparty.tn.o10s.ch]; this should be the website domain or external IP-address which the webbrowser is accessing
12:43:30.789 10.42.0.245 36518     WARN: got header "x-forwarded-for" from untrusted source "10.42.0.245" claiming the true client ip is "10.42.0.245" (raw value: "10.42.0.1");  if you trust this, you must allowlist this proxy with "--xff-src=10.42.0.0/16" or "--xff-src=lan"  Note: depending on your reverse-proxy, and/or WAF, and/or other intermediates, you may want to read the true client IP from another header by also specifying "--xff-hdr=SomeOtherHeader". Some copyparty features are now disabled as a safety measure.

As of now I can understand what I should do, however I don't understand how...
This is probably a misunderstanding on my side as I recently started to use Copyparty but I don't know how to setup options like --xff-src=10.42.0.0/16, is it in the config (if so how ? I didn't find examples...) or is it in the deployment arguments ? (I deploy on Kubernetes, and for now I only do a "-c" with the config file)

Thanks for any feedback / Info / Inputs !