RStudio Server authentication and network binding configuration

Direct answer

Set www-address to 127.0.0.1 (or ::1 for IPv6) when the reverse proxy and RStudio Server run on the same host, or to a specific internal interface address such as 10.0.1.20 when they are separate. Keep auth-style=pam—the default—so the server continues to authenticate users through the system PAM stack even when the proxy terminates TLS.

Binding only where you intend

The default www-address=0.0.0.0 listens on every IPv4 interface. That is convenient but risky: if a firewall or security-group rule is ever loosened, the IDE becomes reachable from an unintended network. Binding explicitly removes that foot-gun.

# /etc/rstudio/rserver.conf
www-address=127.0.0.1
# or, for a dedicated internal NIC:
# www-address=10.0.1.20

After editing, restart the service and confirm the socket:

sudo systemctl restart rserver
sudo ss -ltnp | grep rstudio-server

You should see 127.0.0.1:8787 or the chosen internal IP, not 0.0.0.0:8787.

PAM and reverse-proxy SSL termination

When a reverse proxy handles HTTPS, the connection from the proxy to RStudio Server is usually plain HTTP on the loopback or an internal network. auth-style=pam is unaffected by TLS termination; the server still prompts for a username and password and validates them through PAM. The proxy simply forwards the credentials, for example with HTTP Basic Auth.

Do not set auth-style=none unless the server is unreachable from any untrusted network. Combined with a broad bind address, it creates an unauthenticated entry point.

If you want proxy-managed login

An alternative is auth-style=proxy, where the proxy authenticates the user and injects a header such as X-RStudio-Username. In this mode RStudio Server trusts the proxy and skips PAM. This is only safe if the proxy is the sole path to the server and it overwrites any client-supplied X-RStudio-Username header. If you cannot verify that header stripping, stay with auth-style=pam and Basic Auth through the proxy.

Defense in depth

Even with a specific www-address, add a host firewall rule allowing only trusted sources to reach port 8787. For example, with nftables or iptables, permit the proxy host or management subnet and drop the rest. This protects against future misconfiguration.

Verification checklist

1. Confirm the bind address in /etc/rstudio/rserver.conf.
2. Restart rserver and inspect ss -ltnp output.
3. From the proxy or trusted host, request http://127.0.0.1:8787 (or the internal IP) and confirm the login page appears.
4. From an untrusted network, confirm the port is refused or times out.
5. Check journalctl -u rserver -n 50 for binding or PAM errors after restart.

Instructions assume a current Posit/RStudio Server release; older versions use the same file paths but may differ in service names or available directives. One detail changes the recommendation: if your reverse proxy cannot guarantee that it replaces any inbound X-RStudio-Username header, do not use auth-style=proxy; keep PAM and let the proxy pass Basic Auth credentials.