Nguyen Thanh Dat
92259214db
x-9r-real-ip and the Host fallback were trusted from client-controlled
headers whenever custom-server.js was not in the request path (npm run
start, start:bun), letting a remote caller pose as local to skip API key
auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable,
/api/auth/reset-password).
custom-server.js now generates a per-process secret at boot and stamps it
as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders()
(src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret;
otherwise the guard falls back to Host only in development, and fails
closed in production. Same gate on loginLimiter.getClientIp() so a spoofed
header cannot rotate the login lockout bucket.
Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the
old split(":")[0] reduced to empty string; route npm run start /
start:bun through custom-server.js (postbuild copies it into
.next/standalone, build-cli.js fails without it) so documented deployments
keep passwordless local access.
8 lines
437 B
JavaScript
8 lines
437 B
JavaScript
// x-9r-real-ip is only trustworthy when custom-server.js stamped it from the TCP socket.
|
|
// It proves that by echoing the per-process secret it generated at boot, which a client
|
|
// cannot guess. Without the proof the header is just attacker-supplied input.
|
|
export function hasTrustedPeerHeaders(request) {
|
|
const token = process.env.NINEROUTER_PEER_TOKEN;
|
|
return Boolean(token) && request.headers.get("x-9r-peer-token") === token;
|
|
}
|