.. /*
    * This file is part of the SavaPage project <https://www.savapage.org>.
    * Copyright (c) 2026 Datraverse B.V.
    * Author: Rijk Ravestein.
    *
    * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. <info@datraverse.com>
    * SPDX-License-Identifier: CC-BY-SA-4.0
    *
    * For more information, please contact Datraverse B.V. at this
    * address: info@datraverse.com
    */

.. _ch-security-savapage-cmd:

Server Commands
---------------

The :ref:`Server Command <app-tools-savapage-cmd>` tool provides a
command-line interface to |PRODUCT_NAME| Server methods. The following
security measures apply:

-  Only users with read access to the
   :ref:`server.properties <ch-install-on-linux-config-server-properties>`
   file have the right to execute the command.

-  An SSL connection is used to communicate with the server.

-  An API key is used as client identification.

-  |PRODUCT_NAME| server accepts SSL connections from local host only.
   When remote access to |PRODUCT_NAME| is proxied, e.g. by Apache
   redirect, the remote address will be 127.0.0.1 in all cases.
   Therefore, requests from local loop-back address 127.0.0.1 are
   **not** accepted. The request origin must be a "real" IP address
   identical to the one of the |PRODUCT_NAME| server.

-  At the client, SSL host name verification is turned *off*. This
   allows a mismatch between the server host name and the SSL
   certificate CN.