Error 400 after setting TRUSTED_HOSTS in docker-compose.yaml

[mkne]

After updating to Version 2.13.3 the following message appears with the admin account logged in:

TRUSTED_HOSTS nicht konfiguriert
Die Umgebungsvariable TRUSTED_HOSTS ist nicht gesetzt. Das bedeutet, dass Part-DB Anfragen für jeden beliebigen Hostnamen akzeptiert, was ein Sicherheitsrisiko darstellen kann (z. B. HTTP-Host-Header-Injection). Es wird empfohlen, dies auf die Hostnamen zu beschränken, unter denen Part-DB tatsächlich erreichbar ist.

Legen Sie einen regulären Ausdruck fest, der alle Hostnamen abdeckt, unter denen Part-DB erreichbar sein soll, z. B. basierend auf dem Hostnamen, den Sie für den Zugriff auf diese Seite verwendet haben. Dies ist möglich in Ihrer Datei .env.local oder docker-compose.yaml:
TRUSTED_HOSTS='^(mypartdb)$'

1. So I added the following line in my docker-compose.yaml
   - TRUSTED_HOSTS='^(mypartdb)$'
2. and did
   sudo docker compose up -d
3. (optionally) tried a
   sudo docker exec --user=www-data partdb php bin/console cache:clear
4. and after reloading the page I get greeted by the following Error 400 message:
   400
   Bad Request
   Part-DB was accessed using a host name that is not marked as trusted.
   The host name Part-DB saw was: neli
   You can try to Go Back or Visit the homepage.

If this error persists, please contact your administrator.

Infos for Admin: Untrusted host name.
For security reasons (to prevent HTTP Host header attacks), Part-DB only responds to requests using host names that were explicitly marked as trusted, once more than one host name is used to access it (e.g. behind a reverse proxy).

Try following things:

Ensure that you are using the correct URL to access Part-DB.
Set the TRUSTED_HOSTS environment variable in your .env.local file (or your docker-compose environment) to a regular expression matching all host names Part-DB should be reachable under, e.g. TRUSTED_HOSTS='^(neli)$' (if neli is a host name you trust)
If Part-DB is running behind a reverse proxy, also make sure that TRUSTED_PROXIES is configured correctly, so the original host name is forwarded properly.
Run php bin/console cache:clear after changing the configuration.
If you think that this is an error in Part-DB, open an Issue on GitHub.

You can disable these hints in config/parameters.yaml by setting partdb.error_pages.show_help to false.

I also updated the docker-ce, docker-compose-plugin, ... via apt and tried to use the IP-Address in the TRUSTED_HOSTS.

[jbtronics]

Are you using reverse proxies?

How does the name under which Part-DB is reachable is looking like?

What happens if you set the TRUSTED_HOSTS to neli, like the error message recommends? Or a combination of both?

[henrikkoch]

I had the same finding. I just added what was suggested on that page as a new ENV variable in my Docker, and it disappeared. I'm using a url genereated via cloud flare which I have been doing for several verisons. But this new version of partdb now showed that issue

[mkne]

Sorry, I'm using neli for TRUSTED_HOSTS, I just forgot to replace the string "neli" with "mypartdb" in the error message. I used the exact string that was supposed in the message on the start page: TRUSTED_HOSTS='^(neli)$'
I don't use a TRUSTED_PROXY and my instance is only available from within our intranet. We use the following URL to reach our Part-DB instance: http://neli:8080/de/

[mkne]

I think I found the solution. I recognized that all other variables in docker-compose.yaml don't use quotes.
So I removed the single quote characters and it works now:
not working: TRUSTED_HOSTS='^(neli)$'
working: TRUSTED_HOSTS=^(neli)$

@jbtronics I think the error message should be corrected to display the correct string to be used in docker-compose.yaml. And also the documentation should mention this. Is this something which is a difference in the docker-compose.yaml syntax vs. .env file syntax? Also it should be checked if concatenating several regex patterns with | still works without quotes.

[burbschat]

Thank you for pointing this out. I just hit the exact same problem and was confused until I found this issue, so it seems like a note on this in the documentation and/or the error message might indeed be a good idea.

[salfter]

Thank you for pointing this out. I just hit the exact same problem and was confused until I found this issue, so it seems like a note on this in the documentation and/or the error message might indeed be a good idea.

This. The suggested TRUSTED_HOSTS line to be added to docker-compose.yml should not include quote marks of any kind.

[jbtronics]

Part-DB 2.13.4 should show an more clear message and the documentation was also updated.

[mkne]

@jbtronics Maybe it should be mentioned in the documentation in the KiCad-API section that the root-URL used in the part-db.kicad_httplib has to conform with TRUSTED_HOSTS? In may case I had neli.local instead of just neli in the root-URL.
obviously not working: "root_url": "http://neli.local:8080/en/kicad-api/",
working: "root_url": "http://neli:8080/en/kicad-api/",
It was obviously my fault in this case that I have used neli.local here instead of just neli but both hostnames worked before. I guess I would add the IP and both variants of the hostname to TRUSTED_HOSTS if I had a bigger user base and changing the part-db.kicad_httplib would involve touching every user's machine.