Unable to save to the server when using a domain

[jhorning]

I have layerling set up in docker. When using the IP address, I am able to save designs to the shared folder. When using a domain name through a reverse proxy, I get the error message "Shared projects only accept requests from this site." when trying to save to the server.

I don't have the MCP server enabled but saw in the sample compose file has a variable "LAYERLING_MCP_ALLOWED_HOSTS" to specifying the domain for the MCP server. I tried setting that but it doesn't seem to have any impact on saving to the shared projects folder.

Is there a different environment variable or somewhere else where the allowed domains can be specified?

[henmedia]

@jhorning thank you for the details. LAYERLING_MCP_ALLOWED_HOSTS is only for the MCP server, so it has no effect on saving. There was no allowed-domains setting for shared projects. The check compares the address in the browser with the host and protocol that layerling sees. Behind a proxy that closes HTTPS, layerling sees plain http, or the internal host name, and then the two do not match.

I am fixing this on my side, so it will work out of the box with the next update: layerling will accept the HTTPS address when the proxy does not pass the protocol on, and there will be a new setting LAYERLING_ALLOWED_ORIGINS for a proxy that rewrites the host.

Until then, the fix is in the proxy: it has to pass on the original host and protocol. In nginx that is proxy_set_header Host $host;, proxy_set_header X-Forwarded-Host $host; and proxy_set_header X-Forwarded-Proto $scheme;. In Nginx Proxy Manager or Traefik these headers are usually sent by default, so please check that the proxy host is not rewriting the host.

If you'd like to support the project, a small donation is very welcome. 🙂

[jhorning]

@henmedia Thank you for that information. I am using HAProxy on an OPNsense router. I found out it sends a forwarded header with the host and port instead of the separate X-Forwarded-Host & X-Forwarded-Proto headers.

Everything is working as expected after adding the correct headers.

[henmedia]

@jhorning thank you for telling me, and good that you found the cause. The update that is coming will also accept your HTTPS address without the extra headers, and LAYERLING_ALLOWED_ORIGINS is there if a proxy rewrites the host.

[henmedia]

@jhorning the update is out: 1.92.2 accepts your HTTPS address when the proxy does not pass the protocol on, and has LAYERLING_ALLOWED_ORIGINS for a proxy that rewrites the host. Please pull the new image.