Security And Access

Weaver answers two separate questions:

Who can reach it. The listen address decides which machines can connect at all. In a container, so do the ports you publish.
Who gets in. Every browser signs in with the administrator login. Apps such as Scryer, Sonarr, and Radarr use API keys instead.

No network setting lets a browser skip the login. Listening on your whole LAN, trusting a proxy, or listing a network lets more machines reach the sign-in page. None of them let anyone past it.

Both questions are answered in Settings → Security.

Network Access

Settings → Security → Network access has three fields:

Field	What it does	Takes effect
Remembered-session CIDRs	The networks where Remember this browser is honoured. Empty means anywhere.	Immediately
Trusted proxy addresses or CIDRs	Reverse proxies whose forwarded browser address Weaver believes.	Immediately
Listen address	The address Weaver answers on. `127.0.0.1` means this machine only.	After a restart

The section shows the address Weaver is listening on now and the address saved for the next restart.

Listen Address

Native installs listen on 127.0.0.1, so a fresh install is reachable only from its own machine. To use Weaver from other devices, enter 0.0.0.0 for every interface, or the address of a single interface, and restart Weaver.

Container images already listen on 0.0.0.0. Inside a container that only covers the container’s own network, and the ports you publish decide what is exposed. The image sets it with WEAVER_HTTP_BIND_ADDRESS. That variable always wins over the saved value and makes the field read-only.

If Weaver can’t bind a saved address at startup, for example because a DHCP lease moved or a VPN interface is down, it doesn’t fail. It listens on 127.0.0.1 instead and logs a warning. Listening now on this page shows the address in force.

Trusted Proxy Addresses Or CIDRs

Behind a reverse proxy, every request arrives from the proxy’s address. List the proxy here, one address or CIDR per line. Weaver then reads the browser’s real address from X-Forwarded-For on requests that come from the proxy. Requests from any other address are judged on that address, and their forwarding headers are ignored.

At the bottom of the section, Current connection shows the address your browser connected from (the peer) and the address Weaver settled on for it (the resolved client). The resolved client is what Remembered-session CIDRs are matched against. Requests from a trusted proxy also mark the session cookie Secure when the proxy sends X-Forwarded-Proto: https.

First-run setup asks for the one-time setup code while WEAVER_TRUSTED_PROXIES is set. A proxy saved in Settings doesn’t trigger the code.

Keep the list to proxies you run. Don’t add a Docker gateway or a whole private range to work around an address problem. Anything that can connect from those addresses could then claim to be any browser. WEAVER_TRUSTED_PROXIES sets the list from the environment and makes the field read-only. See Reverse Proxy.

Remembered-Session CIDRs

The sign-in page has a Remember this browser for 30 days checkbox. This list decides where the checkbox takes effect:

Empty (the default). Any browser can be remembered.
One or more networks. A browser is remembered only while its address is inside one of them. Signing in from outside still works, but that session ends when the browser closes. A remembered browser that later connects from outside the list is asked to sign in again.

This list only controls how long a sign-in lasts. It never lets anyone in without a password.

Behind a reverse proxy, list the browsers’ networks here and the proxy under Trusted proxy addresses or CIDRs. Otherwise every browser appears to come from the proxy, and Weaver can’t tell them apart.

WEAVER_TRUSTED_CIDRS sets this list from the environment and makes the field read-only, but only together with WEAVER_ACCESS_MODE=authenticated. On its own, the variable tells a fresh install to use the older access settings, where those networks get in without a login. That choice is permanent, so set both variables from the first start.

Saving Changes

Under Login Protection → Sensitive changes, choose Verify Password. A verification lasts 15 minutes in that browser.
Edit the fields and choose Preview changes. Weaver checks every entry and reports what the draft resolves to. It also says whether the listen address needs a restart, and whether your current browser would stop qualifying to be remembered.
Choose Save network access.

A field set by an environment variable is read-only. The page names WEAVER_HTTP_BIND_ADDRESS for the listen address, and says the two lists are pinned by the deployment environment. If the saved lists can’t be read, Weaver stops remembering any browser and shows a warning here. Saving both lists again clears it.

Hostnames

Weaver answers any hostname. That includes localhost, an IP address, a NAS name like nas.local, a Docker service name like weaver, and a public name a proxy forwards. None of them has to be listed.

WEAVER_HTTP_ALLOWED_HOSTS is an optional restriction. Once it’s set, Weaver answers only the names on the list, plus localhost and plain IP addresses. It refuses every other name with 421 request Host is not allowed:

WEAVER_HTTP_ALLOWED_HOSTS: "weaver,weaver.example.com"

Separate names with commas, without https:// or a path. Matching is exact and ignores case. There are no wildcards, and a subdomain counts as a different name. An entry with :port matches only that port and refuses requests without one, so leave ports off unless you mean to require one.

Signing In

The administrator login is created during first-run setup, or from the bootstrap variables on a headless install. It can’t be turned off.

How long a sign-in lasts. A remembered browser stays signed in for up to 30 days. Any other session ends when the browser closes, and never lasts longer than 30 days.
One sign-in per address. A session belongs to the address you signed in at, such as http://nas.local:9090 or https://weaver.example.com. Opening Weaver at a different address means signing in there too. A reverse proxy must pass the browser’s Origin header through unchanged.
HTTPS. Weaver marks the session cookie Secure when you sign in over HTTPS, including through a trusted proxy that sends X-Forwarded-Proto: https. WEAVER_SECURE_COOKIES=1 marks it Secure everywhere.
Signing out. Sign Out ends this browser’s session. Sign Out Everywhere ends every browser session.
Sensitive changes. Changing the password, network access, API keys, backups, post-processing settings, the script folder, or the script lists needs a Verify Password from the same browser within the last 15 minutes. Requests made with an API key are not asked.

Locked out? Set WEAVER_RESET_LOGIN=1 and restart. Weaver clears the stored login. If the bootstrap variables are still set, as in the Docker example, the login is recreated from them and you sign in with those. Otherwise setup opens again and asks for a new login, with a setup code when Weaver listens beyond this machine. Remove the variable once you’re back in. Configuration documents the bootstrap variables.

API Keys

Under Settings → Security → API Keys, create an API key with scope Control the queue for Scryer and other download-client integrations. A key is shown once, when it’s created. Each key has a scope:

Scope	Allows
Read	Queries: queue, history, status, metrics
Control the queue	Read, plus submitting, pausing, resuming, editing, and cancelling jobs
Admin	Everything, including settings changes and destructive history operations

Use Control the queue for Scryer, Sonarr, Radarr, and other clients that submit jobs. Use Read for monitoring. Keys work for the GraphQL API, the NZBGet-compatible API, and /metrics, from any network. See API And Metrics.

Strict Mode

WEAVER_STRICT_SECURITY=1 refuses to run post-processing scripts, whatever Settings → Post-processing says. On an install still using the older access settings, it also refuses to start while any trusted network is set, with or without a login, or while Weaver listens beyond this machine without a login.

Set it on anything internet-adjacent. Serve Weaver over HTTPS, and keep the listen address as narrow as your setup allows.

Installs That Predate 0.12.0

Upgrading doesn’t change who gets in. An install set up before 0.12.0 keeps its older access settings, which work differently:

Settings → Security offers three choices for browser access: Login required for every browser, Login required, except trusted local networks, and No login (this machine only).
While no login exists, browsers inside the trusted networks get full administrative access without signing in. Once a login exists, every browser signs in. Behind a proxy, name the proxy in WEAVER_TRUSTED_PROXIES, and never put the proxy’s own address in the trusted list.
WEAVER_TRUSTED_CIDRS pins those trusted networks, and Weaver logs a warning at every start while it is set. A fresh install started with this variable, and without WEAVER_ACCESS_MODE=authenticated, uses these older settings from then on.
Trusted proxies can only be set with WEAVER_TRUSTED_PROXIES.
Every hostname other than localhost and IP addresses must be listed in WEAVER_HTTP_ALLOWED_HOSTS.

To move an existing install to the 0.12.0 model, set WEAVER_ACCESS_MODE=authenticated and restart Weaver. The value must be exactly authenticated.

An install with a login keeps its username, password, and API keys, and every browser signs in again. Networks that used to skip the login become the Remembered-session CIDRs. The move is permanent from that start, so you can remove the variable afterwards. Keep it if WEAVER_TRUSTED_CIDRS stays set.
An install without a login opens setup to create one, with a setup code when Weaver listens beyond this machine. Setup stays open across restarts until it’s finished.

Reverse Proxy covers trusted proxies, hostnames, and subpaths.
Setup Code explains when first-run setup asks for a code and where to find it.
Configuration documents every variable named here.
Backup And Restore explains which security settings travel with a backup.