Repository navigation
docs(configuration): document plugin access to the local network - #21
Open
jannefleischer wants to merge 1 commit into
Open
jannefleischer wants to merge 1 commit into
jannefleischer wants to merge 1 commit into
Conversation
This was referenced Oct 4, 2026
Open
jannefleischer
force-pushed
the
docs/local-network-access-plugins
branch
2 times, most recently
from
October 4, 2026 07:35
8b59e8a to
364d870
Compare
jannefleischer
marked this pull request as ready for review
October 4, 2026 07:45
Documents ALLOW_LOCAL_NETWORK_ACCESS_IFRAMES / security.allowLocalNetworkAccessIframes (default false) in configuration/server.md with a security warning and browser support notes (Chromium, Firefox 153+, no Safari yet), and links it from configuration/plugins.md. AI-assisted; disclosed per the AI Contribution Policy. Signed-off-by: jannefleischer <janne.fleischer@ils-forschung.de>
jannefleischer
force-pushed
the
docs/local-network-access-plugins
branch
from
October 4, 2026 07:52
364d870 to
19be2d1
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Companion to Euro-Office/web-apps#276, Euro-Office/sdkjs#95, Euro-Office/server#53 and Euro-Office/DocumentServer#399. Those PRs make delegating the browser's
local-network-access/loopback-networkpermission to plugin iframes an opt-in by the server operator (config keysecurity.allowLocalNetworkAccessIframes, env varALLOW_LOCAL_NETWORK_ACCESS_IFRAMES, defaultfalse). This is needed e.g. for an AI plugin that calls an internal Ollama instance from the browser.Change
docs/configuration/server.md:security.allowLocalNetworkAccessIframes!!! warningon the security impact (in the style ofUSE_UNAUTHORIZED_STORAGE) and a note on browser support (Chromium and Firefox ≥ 153; Safari not supported yet, WebKit implementing it)docs/configuration/plugins.md: short section "Plugins that access the local network" linking to the above, since that is where admins look when a plugin cannot reach an internal service.Caveats
Not built locally (
mkdocsnot installed here). Draft until the code PRs are agreed on and merged; the setting does not exist before that.AI-assisted; disclosed per the AI Contribution Policy.