An Otter Wiki Proxy Header Can Carry More Than an Identity
An Otter Wiki Proxy Header Can Carry More Than an Identity An Otter Wiki is a small self-hosted wiki built with Python, Markdown, and Git. The first account created in a deployment becomes an administrator. The project
An Otter Wiki Proxy Header Can Carry More Than an Identity
An Otter Wiki is a small self-hosted wiki built with Python, Markdown, and Git. The first account created in a deployment becomes an administrator. The project also supports proxy-header authentication, which lets a reverse proxy supply the authenticated user and a permission list.
The ZoomEye measurement on 15 November 2026 found 0 matches for app="Otterwiki", 2 for title="Otterwiki", and 267 for http.body="Otterwiki" with sub_type=all, page 1, and page size 1. These are very small discovery counts. The body result can include documentation and package pages, so it should not be read as two hundred live deployments.
The proxy must overwrite the header
Otter Wiki's configuration documentation describes AUTH_METHOD='PROXY_HEADER' and an x-otterwiki-permissions header whose accepted values include READ, WRITE, UPLOAD, and ADMIN. That design is only safe when the reverse proxy removes any client-supplied value and writes the trusted identity and permission headers after successful authentication. A proxy that appends to the request or preserves unknown headers can let a caller choose its own permissions.
The header set is an authorization decision, not a display name. The proxy and the wiki must agree on the possible values, the default when no header is present, and the behavior for an invalid value. Test each permission and confirm that WRITE does not imply ADMIN, that an anonymous request cannot upload, and that a revoked identity loses access immediately.
The first administrator should be created through a controlled setup and removed from the bootstrap path afterward. Review registration, password recovery, user administration, and the Git server integration. The repository-management documentation notes that users with READ can pull and users with UPLOAD can push when the Git server is enabled. That turns repository access into a second permission surface.
Inventory the content path
List the wiki hostname, version, authentication mode, proxy identity source, administrator, Git server state, storage location, and backup policy. Review custom templates and injected HTML because the wiki renders content for other users. Check whether attachments and repository remotes can reach internal addresses or execute deployment hooks.
The title count is not enough to identify the deployment, but the configuration question is clear. If the wiki trusts a header, the network path to the wiki must be limited to the proxy that sets it. A reverse proxy with permissive header forwarding can turn a logging or SSO integration into an administrator path.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.