Update from code changes: document HARLY_URL production validation - #33
Open
mintlify[bot] wants to merge 1 commit into
Open
Update from code changes: document HARLY_URL production validation#33mintlify[bot] wants to merge 1 commit into
mintlify[bot] wants to merge 1 commit into
Conversation
Contributor
Author
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
|
📚 No documentation changes were needed for this PR. |
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+26
to
+27
| - Contain no userinfo, query string, or fragment. Only scheme, host, and | ||
| optional port are accepted. |
There was a problem hiding this comment.
The startup configuration validator does not reject userinfo, query strings, or fragments as documented here; that stricter check occurs later in getHarlyPublicOrigin(), so an invalid value can pass startup configuration validation and fail only when an affected application path loads.
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/docs/deployment/configuration.mdx
Line: 26-27
Comment:
**Startup rejection is overstated**
The startup configuration validator does not reject userinfo, query strings, or fragments as documented here; that stricter check occurs later in `getHarlyPublicOrigin()`, so an invalid value can pass startup configuration validation and fail only when an affected application path loads.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Document that Harly now validates
HARLY_URLat startup in production and rejects HTTP, loopback, and bind addresses.Changes
HARLY_URLvalidation section todeployment/configuration.mdxcovering the HTTPS requirement, rejected hostnames (localhost,127.0.0.0/8,::1,0.0.0.0,::), no-userinfo/query/fragment rule, and the startup-failure behavior.HARLY_URL, so reverse-proxy operators must not leak internal bind addresses.HARLY_URLto the public hostname" subsection under the external reverse proxy guidance inself-hosting/proxy-modes.mdx, cross-linking to the validation reference.Context
Follows #32, which hardened production configuration to reject internal origins in
HARLY_URL.Greptile Summary
This PR documents production validation and deployment guidance for configuring
HARLY_URL.HARLY_URLaffects generated public URLs.Confidence Score: 4/5
The PR appears safe to merge, though the startup-validation documentation should distinguish the weaker configuration check from the later public-origin validation.
The documentation currently promises startup rejection of credentials, query strings, and fragments even though the startup configuration validator accepts them and the stricter rejection occurs only when the public-origin helper loads.
Files Needing Attention: apps/docs/deployment/configuration.mdx
Important Files Changed
HARLY_URLvalidation guidance, but overstates which URL components the startup configuration validator rejects.Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "docs: document HARLY_URL production vali..." | Re-trigger Greptile