{{ message }}
Repository navigation
Conversation
NewHTTPClient carries the proxy and timeout settings without the SSRF guard, for admin-configured endpoints like OIDC providers that often live on a private network. NewSSRFSafeHTTPClient builds on it.
github-actions
Bot
added
area/config
outgoingrequests.proxyurl was silently ignored unless proxypassword was set too, and the username was hardcoded to vikunja. Credentials in the proxy url are used now, with proxypassword as the mole-compatible fallback. Plain http requests through the proxy now authenticate too, not only CONNECT tunnels. An unparseable proxy url fails requests instead of connecting directly.
…the SSRF guard The proxy dial exemption was keyed on addresses learned lazily from earlier proxied requests, so a direct request (loopback, NO_PROXY or an unproxied scheme) or a redirect to the proxy's host:port was dialed unguarded. Derive the exempt addresses once from the configured or environment proxy URLs and reject direct requests to them with ssrf.ErrProhibitedIP. Address pr-swarm finding: SSRF guard bypass via the proxy address
Address review comment: make the missing SSRF guard obvious at the call site
BREAKING CHANGE: outgoingrequests.proxypassword is no longer used. Put the credentials into outgoingrequests.proxyurl instead, for example http://vikunja:password@mole:8080.
Ignoring the removed keys would leave the proxy rejecting every request with a 407, so startup fails with a hint to move the credentials into outgoingrequests.proxyurl. BREAKING CHANGE: outgoingrequests.proxypassword and webhooks.proxypassword were removed. Vikunja refuses to start when either is set.
tink-bot
force-pushed
the
refactor/outgoing-requests-http-client
branch
from
September 30, 2026 14:08
f7ed27f to
645bf2d
Compare
tink-bot
force-pushed
the
feat/remove-proxy-password
branch
from
September 30, 2026 14:08
96b5742 to
aa6bafc
Compare
kolaente
force-pushed
the
refactor/outgoing-requests-http-client
branch
from
September 30, 2026 14:08
645bf2d to
057de82
Compare
Base automatically changed from
refactor/outgoing-requests-http-client
to
main
September 30, 2026 16:26
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two ways to pass proxy credentials (
proxyurluserinfo vsproxypasswordwith implicitvikunjausername) = extra rules, extra tests, surprising precedence. Keep one: URL.Follow-up to #4016, based on its branch because credentials in
proxyurlonly exist there. Not part of the stack; GitHub retargets tomainonce #4016 merges.Removed keys listed in
removedConfigKeys; #4063 adds webhook keys to same table, merge conflict = union of entries.Review guide: decision to review = fail startup vs. ignore. Ignoring would make proxy answer 407 to every outgoing request, silently.
Breaking changes
outgoingrequests.proxypasswordand the deprecatedwebhooks.proxypasswordhave been removed. Vikunja now refuses to start when either one is set, and the error message explains how to move the credentials intooutgoingrequests.proxyurl, for examplehttp://vikunja:<url-encoded password>@mole:8080. Special characters in the password must be URL-encoded.How to verify
outgoingrequests.proxypassword: secretin the config (orVIKUNJA_OUTGOINGREQUESTS_PROXYPASSWORD=secret) and start Vikunja.config key "outgoingrequests.proxypassword" was removed, put the proxy credentials into "outgoingrequests.proxyurl" instead, ....outgoingrequests.proxyurl: http://vikunja:secret@<proxy>:8080against a proxy that requires basic auth, and trigger a webhook.vikunja.