build: Release

.gitignore

@@ -21,3 +21,6 @@ test_logs
 # AI tools
 .claude
 .superpowers
+
+# Docs
+/docs/

Parse-Dashboard/app.js

@@ -87,13 +87,52 @@ module.exports = function(config, options) {
       cookieSessionStore: options.cookieSessionStore
     });
 
+    // Headers set by reverse proxies to describe the original client. Their
+    // presence means the request was relayed and did not originate on this host.
+    // The `x-forwarded-` prefix is matched as a whole because proxies vary in
+    // which of them they set, and any single one is enough to reveal a relay.
+    const forwardingHeaderPrefix = 'x-forwarded-';
+    const forwardingHeaders = ['x-real-ip', 'forwarded'];
+
     /**
-     * Checks whether a request is from localhost.
+     * Checks whether the connection was opened from this host.
+     *
+     * This describes the connection, not the client: a reverse proxy running on
+     * the same host also connects over loopback, so a true result does not mean
+     * the client is local. Use it only to decide whether the connection itself
+     * needs encrypting, never to grant access.
+     */
+    function isLoopbackPeer(req) {
+      // The whole of 127.0.0.0/8 is loopback, not just 127.0.0.1. The address is
+      // absent on a socket that has already been destroyed.
+      const address = req.socket.remoteAddress;
+      return typeof address === 'string' && (
+        address.startsWith('127.') ||
+        address.startsWith('::ffff:127.') ||
+        address === '::1'
+      );
+    }
+
+    /**
+     * Checks whether a request originated on this host.
+     *
+     * Stricter than `isLoopbackPeer`, because a same-host reverse proxy would
+     * otherwise make every request it relays look local. A request counts as
+     * local only when nothing indicates it was relayed.
      */
     function isLocalRequest(req) {
-      return req.connection.remoteAddress === '127.0.0.1' ||
-        req.connection.remoteAddress === '::ffff:127.0.0.1' ||
-        req.connection.remoteAddress === '::1';
+      // A configured proxy relays every request, so no request is local.
+      if (config.trustProxy) {
+        return false;
+      }
+      // Forwarding headers are never sent by a client on this host.
+      const isForwarded = Object.keys(req.headers).some(header =>
+        header.startsWith(forwardingHeaderPrefix) || forwardingHeaders.includes(header)
+      );
+      if (isForwarded) {
+        return false;
+      }
+      return isLoopbackPeer(req);
     }
 
     /**
@@ -102,11 +141,15 @@ module.exports = function(config, options) {
      * - Requires users to be configured for remote access (unless dev mode is enabled)
      */
     function enforceRemoteAccessRestrictions(req, res, next) {
-      if (!options.dev && !isLocalRequest(req)) {
-        if (!req.secure && !options.allowInsecureHTTP) {
+      if (!options.dev) {
+        // Keyed on the connection: a loopback connection cannot be observed off
+        // this host, so it needs no encryption of its own.
+        if (!isLoopbackPeer(req) && !req.secure && !options.allowInsecureHTTP) {
           return res.status(403).json({ error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
         }
-        if (!users) {
+        // Keyed on the client: granting access requires knowing where the
+        // request came from, which a relayed request cannot establish.
+        if (!isLocalRequest(req) && !users) {
           return res.status(401).json({ error: 'Configure a user to access Parse Dashboard remotely' });
         }
       }
@@ -135,13 +178,13 @@ module.exports = function(config, options) {
         agent: config.agent,
       };
 
-      if (!options.dev && !isLocalRequest(req)) {
-        if (!req.secure && !options.allowInsecureHTTP) {
+      if (!options.dev) {
+        if (!isLoopbackPeer(req) && !req.secure && !options.allowInsecureHTTP) {
           //Disallow HTTP requests except on localhost, to prevent the master key from being transmitted in cleartext
           return res.send({ success: false, error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
         }
 
-        if (!users) {
+        if (!isLocalRequest(req) && !users) {
           //Accessing the dashboard over the internet can only be done with username and password
           return res.send({ success: false, error: 'Configure a user to access Parse Dashboard remotely' });
         }

Parse-Dashboard/server.js

@@ -191,11 +191,18 @@ module.exports = (options) => {
   // Mount parseDashboard with authentication
   app.use(mountPath, parseDashboard(config.data, dashboardOptions));
 
+  // 0.0.0.0 (IPv4) and :: (IPv6) are bind-all addresses: they are not directly
+  // navigable and browsers do not treat them as a secure context, which breaks
+  // Web APIs the dashboard relies on (e.g. crypto.randomUUID used by the Parse
+  // SDK). Advertise localhost instead so the printed URL actually works.
+  const displayHost = address =>
+    address === '0.0.0.0' || address === '::' ? 'localhost' : address;
+
   let server;
   if(!configSSLKey || !configSSLCert){
     // Start the server.
     server = app.listen(port, host, function () {
-      console.log(`The dashboard is now available at http://${server.address().address}:${server.address().port}${mountPath}`);
+      console.log(`The dashboard is now available at http://${displayHost(server.address().address)}:${server.address().port}${mountPath}`);
 
       // Initialize browser control WebSocket if enabled
       if (browserControlSetup) {
@@ -211,7 +218,7 @@ module.exports = (options) => {
       key: privateKey,
       cert: certificate
     }, app).listen(port, host, function () {
-      console.log(`The dashboard is now available at https://${server.address().address}:${server.address().port}${mountPath}`);
+      console.log(`The dashboard is now available at https://${displayHost(server.address().address)}:${server.address().port}${mountPath}`);
 
       // Initialize browser control WebSocket if enabled
       if (browserControlSetup) {

changelogs/CHANGELOG_alpha.md

@@ -1,3 +1,45 @@
+# [9.3.0-alpha.5](https://github.com/parse-community/parse-dashboard/compare/9.3.0-alpha.4...9.3.0-alpha.5) (2026-08-11)
+
+
+### Bug Fixes
+
+* Remote access restrictions not enforced when running behind a reverse proxy ([#3436](https://github.com/parse-community/parse-dashboard/issues/3436)) ([60cb379](https://github.com/parse-community/parse-dashboard/commit/60cb3791bd95325ee04d5e354c034d54817c89ac))
+
+# [9.3.0-alpha.4](https://github.com/parse-community/parse-dashboard/compare/9.3.0-alpha.3...9.3.0-alpha.4) (2026-07-25)
+
+
+### Bug Fixes
+
+* Info panel data not loaded when opened over an existing selection ([#3384](https://github.com/parse-community/parse-dashboard/issues/3384)) ([4879959](https://github.com/parse-community/parse-dashboard/commit/4879959f08286cb2e55515027f8b40e90ab392c1))
+
+# [9.3.0-alpha.3](https://github.com/parse-community/parse-dashboard/compare/9.3.0-alpha.2...9.3.0-alpha.3) (2026-07-25)
+
+
+### Bug Fixes
+
+* Add Cancel and Add buttons to the add-row modal ([#1995](https://github.com/parse-community/parse-dashboard/issues/1995)) ([#3383](https://github.com/parse-community/parse-dashboard/issues/3383)) ([2d1b739](https://github.com/parse-community/parse-dashboard/commit/2d1b739dad3b39a5c42dfa56afa96b2b76ba26b2))
+
+# [9.3.0-alpha.2](https://github.com/parse-community/parse-dashboard/compare/9.3.0-alpha.1...9.3.0-alpha.2) (2026-07-23)
+
+
+### Bug Fixes
+
+* Prevent Config table crash when a parameter value is null ([#3424](https://github.com/parse-community/parse-dashboard/issues/3424)) ([7150acf](https://github.com/parse-community/parse-dashboard/commit/7150acfb43a7ca60345e746d4cb9f4d38cb540aa))
+
+# [9.3.0-alpha.1](https://github.com/parse-community/parse-dashboard/compare/9.2.1-alpha.1...9.3.0-alpha.1) (2026-07-18)
+
+
+### Features
+
+* React 19 + react-router 7 + GraphiQL 5 coordinated upgrade ([#3409](https://github.com/parse-community/parse-dashboard/issues/3409)) ([c3e16c2](https://github.com/parse-community/parse-dashboard/commit/c3e16c27d5c98e1981d1d7b06b33d3d9e355b183))
+
+## [9.2.1-alpha.1](https://github.com/parse-community/parse-dashboard/compare/9.2.0...9.2.1-alpha.1) (2026-07-17)
+
+
+### Bug Fixes
+
+* Advertise localhost instead of 0.0.0.0 in the dashboard startup message ([#3410](https://github.com/parse-community/parse-dashboard/issues/3410)) ([33ce7b8](https://github.com/parse-community/parse-dashboard/commit/33ce7b8d283855f8398f6111d8f557081d11d018))
+
 # [9.2.0-alpha.1](https://github.com/parse-community/parse-dashboard/compare/9.1.2-alpha.1...9.2.0-alpha.1) (2026-07-04)