[GH-ISSUE #724] Discussion: Serve in a subfolder

kerem commented

2026-03-14 23:06:48 +03:00

Owner

Originally created by @danisztls on GitHub (Apr 26, 2021).
Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/724

Current paths are:

mydomain/public/...
mydomain/private/...
mydomain/static/...

I suggest optionally having it under a subfolder to make it easier to put ArchiveBox under a reverse proxy like Nginx.

mydomain/archivebox/public/...
mydomain/archivebox/private/...
mydomain/archivebox/static/...

Is it feasable?

Originally created by @danisztls on GitHub (Apr 26, 2021). Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/724 Current paths are: ``` mydomain/public/... mydomain/private/... mydomain/static/... ``` I suggest optionally having it under a subfolder to make it easier to put ArchiveBox under a reverse proxy like Nginx. ``` mydomain/archivebox/public/... mydomain/archivebox/private/... mydomain/archivebox/static/... ``` Is it feasable?

kerem

2026-03-14 23:06:48 +03:00

closed this issue
added the
touches: configuration

size: hard

why: security

status: wontfix
labels

kerem commented

2026-03-14 23:07:04 +03:00

Author

Owner

@pirate commented on GitHub (Apr 27, 2021):

It's pretty difficult, but not impossible, there are a lot of /relative urls all over the codebase. A bunch are in the static html too, so it's hard to change them after-the-fact since they wouldn't be re-rendered after you reconfigure it automatically.

@pirate commented on GitHub (Apr 27, 2021): It's pretty difficult, but not impossible, there are a lot of `/relative` urls all over the codebase. A bunch are in the static html too, so it's hard to change them after-the-fact since they wouldn't be re-rendered after you reconfigure it automatically.

kerem commented

2026-03-14 23:07:10 +03:00

Author

Owner

@pirate commented on GitHub (Apr 27, 2021):

Reopening because I do want to allow this to be done eventually when I have time, it just probably wont be done anytime soon.

@pirate commented on GitHub (Apr 27, 2021): Reopening because I do want to allow this to be done eventually when I have time, it just probably wont be done anytime soon.

kerem commented

2026-03-14 23:07:15 +03:00

Author

Owner

@FraMecca commented on GitHub (Aug 18, 2021):

What about this:
https://ubuntu.com/blog/django-behind-a-proxy-fixing-absolute-urls

@FraMecca commented on GitHub (Aug 18, 2021): What about this: https://ubuntu.com/blog/django-behind-a-proxy-fixing-absolute-urls

kerem commented

2026-03-14 23:07:20 +03:00

Author

Owner

@mhfowler commented on GitHub (Aug 18, 2021):

fwiw this would be helpful for the purpose of packaging archivebox as a yunohost package, something I've been working on. discussed here https://forum.yunohost.org/t/nginx-config-for-path/16887

@mhfowler commented on GitHub (Aug 18, 2021): fwiw this would be helpful for the purpose of packaging archivebox as a yunohost package, something I've been working on. discussed here https://forum.yunohost.org/t/nginx-config-for-path/16887

kerem commented

2026-03-14 23:07:25 +03:00

Author

Owner

@ss89 commented on GitHub (Mar 12, 2022):

i'd also like to see this feature

@ss89 commented on GitHub (Mar 12, 2022): i'd also like to see this feature

kerem commented

2026-03-14 23:07:30 +03:00

Author

Owner

@pirate commented on GitHub (Mar 13, 2022):

Doing this breaks a surprising amount of things because of how relative paths are written statically to the filesystem in the index.json/html files. It's fixable with rewriting in a Django middleware but it's complicated and there are a lot of edge cases and it's still low on my personal priority list.

@pirate commented on GitHub (Mar 13, 2022): Doing this breaks a surprising amount of things because of how relative paths are written statically to the filesystem in the index.json/html files. It's fixable with rewriting in a Django middleware but it's complicated and there are a lot of edge cases and it's still low on my personal priority list.

kerem commented

2026-03-14 23:07:35 +03:00

Author

Owner

@hellodword commented on GitHub (Feb 28, 2023):

totally agree

@hellodword commented on GitHub (Feb 28, 2023): totally agree

kerem commented

2026-03-14 23:07:40 +03:00

Author

Owner

@pirate commented on GitHub (Feb 28, 2023):

I think I'm actually going to close this as wontfix because of the security issues. ArchiveBox really should only be hosted from a dedicated subdomain, because it's extremely risky to rehost archived JS on a domain shared with other sites. It breaks CORS / CSRF / CSP and many other web security mechanisms to have untrusted content and JS on a domain shared with other apps. It's already risky enough hosting the admin UI on the same domain as snapshot content, let alone exposing that risk to other apps.

It's the same reason why user-uploaded content is stored on xxx.googleusercontent.com instead of google.com, or raw.githubusercontent.com instead of github.com. Most big companies don't keep arbitrary untrusted web content on the same domain (even subdomain) as trusted application code. It's very hard to sanitize HTML/JS/CSS 100% perfectly, rather than take the risk they just quarantine it on a domain with no auth cookies. https://security.googleblog.com/2012/08/content-hosting-for-modern-web.html

For more info see here: https://github.com/ArchiveBox/ArchiveBox/issues/239

@pirate commented on GitHub (Feb 28, 2023): I think I'm actually going to close this as `wontfix` because of the security issues. ArchiveBox really should only be hosted from a dedicated subdomain, because it's extremely risky to rehost archived JS on a domain shared with other sites. It breaks CORS / CSRF / CSP and many other web security mechanisms to have untrusted content and JS on a domain shared with other apps. It's already risky enough hosting the admin UI on the same domain as snapshot content, let alone exposing that risk to other apps. It's the same reason why user-uploaded content is stored on `xxx.googleusercontent.com` instead of `google.com`, or `raw.githubusercontent.com` instead of `github.com`. Most big companies don't keep arbitrary untrusted web content on the same domain (even subdomain) as trusted application code. It's very hard to sanitize HTML/JS/CSS 100% perfectly, rather than take the risk they just quarantine it on a domain with no auth cookies. https://security.googleblog.com/2012/08/content-hosting-for-modern-web.html For more info see here: https://github.com/ArchiveBox/ArchiveBox/issues/239

kerem commented

2026-03-14 23:07:45 +03:00

Author

Owner

@sasasqt commented on GitHub (Aug 22, 2023):

well, if you insist, here is the nginx code that redirect yourdomain/archivebox/ to 127.0.0.1:8000

http {
    map "$http_referer$request_method" $archivebox_post {
        default 0;
        "~.*/archivebox/.*POST" 1;
    }
    map "$http_referer$request_method" $archivebox_get {
        default 0;
        "~.*/archivebox/.*GET" 1;
    }
    server {
        location / {
            root   html;
            index  index.html index.htm;
            if ($archivebox_post) {
                return 307 /archivebox/$request_uri;
            }
            if ($archivebox_get) {
                return 301 /archivebox/$request_uri;
            }
        }
        location /archivebox {
            return 302 /archivebox/;
        }
        location /archivebox/ {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect / /archivebox/;
            proxy_pass http://127.0.0.1:8000/;
        }
    }
}

@sasasqt commented on GitHub (Aug 22, 2023): well, if you insist, here is the nginx code that redirect yourdomain/archivebox/ to 127.0.0.1:8000 ``` http { map "$http_referer$request_method" $archivebox_post { default 0; "~.*/archivebox/.*POST" 1; } map "$http_referer$request_method" $archivebox_get { default 0; "~.*/archivebox/.*GET" 1; } server { location / { root html; index index.html index.htm; if ($archivebox_post) { return 307 /archivebox/$request_uri; } if ($archivebox_get) { return 301 /archivebox/$request_uri; } } location /archivebox { return 302 /archivebox/; } location /archivebox/ { proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_redirect / /archivebox/; proxy_pass http://127.0.0.1:8000/; } } } ```

Rows
Columns

[GH-ISSUE #724] Discussion: Serve in a subfolder #3477