Adds a security remark regarding proxied content and the host address,

and reference to mod_remoteip, as per comment added by Allard Hoeve to
doc.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1346405 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_authz_host.xml b/docs/manual/mod/mod_authz_host.xml
index 30bef026697585c3eb8567f19d13744d27944b61..1e16661ac35a75150d22d5749789a14f4c5fd76c 100644 (file)
--- a/docs/manual/mod/mod_authz_host.xml
+++ b/docs/manual/mod/mod_authz_host.xml
@@ -167,6 +167,18 @@ Require host .net example.edu
     <highlight language="config">
     Require local
     </highlight>
+
+</section>
+
+<section id="proxy"><title>Security Note</title>
+
+    <p>If you are proxying content to your server, you need to be aware
+    that the client address will be the address of your proxy server,
+    not the address of the client, and so using the <code>Require</code>
+    directive in this context may not do what you mean. See
+    <module>mod_remoteip</module> for one possible solution to this
+    problem.</p>
+
 </section>
 
 </section>