Security and HTTPS

Middlewarr limits which API paths and methods an integration can reach through a configured proxy. Keep upstream services and the administration interface reachable only by the clients that need them.

Keep the access boundary meaningful

An integration needs its proxy URL and proxy key. Store the upstream API key in Middlewarr’s service configuration.

If the integration can still reach the upstream service directly and has credentials for it, it can bypass Middlewarr. Use your network and service configuration to control that direct access.

A granted path can expose broad operations. Middlewarr does not add per-item, query-parameter, or request-body authorization. Review the upstream API’s behavior when granting write or command endpoints.

Administration sessions

The dashboard uses one local administrator account. Signing in creates an HttpOnly session cookie. The current session limits are 30 days absolute lifetime and 24 hours idle time. Changing the password revokes existing sessions.

Proxy and upstream API keys do not authenticate administration routes. State-changing administration requests also have an origin check.

Protect host access and backups: anyone who controls the data directory or startup environment can change the installation, including resetting the administrator.

Put HTTPS in front of Middlewarr

The supplied server uses plain HTTP on port 80. Terminate HTTPS at your reverse proxy and forward to Middlewarr over your private network.

Use a dedicated hostname at the root of the site. The application has fixed paths including /api, /proxy, and /health; this guide does not assume deployment under an extra prefix such as /middlewarr.

Your reverse proxy should:

• Forward the original path and query without removing /proxy/{appSlug}.
• Preserve the browser-facing Host, including a non-default port if one is used. The administration origin check compares it with the request’s Origin host.
• Preserve the Origin header and administration cookies.
• Forward X-Api-Key on proxy requests.
• Support streaming responses for live logs without buffering them indefinitely.

After enabling HTTPS, set this in /data/settings.yml and restart:

auth:
  cookieSecure: true

The Secure attribute depends on the connection between the browser and your site. It can be enabled when HTTPS terminates at a reverse proxy even though Middlewarr receives HTTP internally. A plain-HTTP deployment normally needs false, or the browser may not retain the session cookie.

If sign-in works but saving settings returns 403, check the forwarded Host and Origin before changing authentication settings.

Reduce accidental exposure

Use a trusted network or VPN for administration. When a reverse proxy on the same host is the entry point, bind the published backend port to loopback. For a proxy in another container, use an appropriate shared private network.

Backups contain service keys, proxy keys, notification URLs, and session state. Restrict access to them and review logs before sharing. Rotate a proxy key if it has been exposed.