fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)

x-9r-real-ip and the Host fallback were trusted from client-controlled
headers whenever custom-server.js was not in the request path (npm run
start, start:bun), letting a remote caller pose as local to skip API key
auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable,
/api/auth/reset-password).

custom-server.js now generates a per-process secret at boot and stamps it
as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders()
(src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret;
otherwise the guard falls back to Host only in development, and fails
closed in production. Same gate on loginLimiter.getClientIp() so a spoofed
header cannot rotate the login lockout bucket.

Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the
old split(":")[0] reduced to empty string; route npm run start /
start:bun through custom-server.js (postbuild copies it into
.next/standalone, build-cli.js fails without it) so documented deployments
keep passwordless local access.

tests/unit/custom-server-peer-headers.test.js

@@ -0,0 +1,86 @@
+// custom-server.js is the only thing that makes x-9r-real-ip trustworthy. Boot a real
+// HTTP server through it and confirm a client cannot smuggle its own peer headers in.
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { createRequire } from "node:module";
+import http from "node:http";
+import { __test__ as requestDetails } from "@/lib/db/repos/requestDetailsRepo.js";
+
+const require = createRequire(import.meta.url);
+
+let server;
+let baseUrl;
+let seenHeaders;
+
+beforeAll(async () => {
+  require("../../custom-server.js");
+  server = http.createServer((req, res) => {
+    seenHeaders = req.headers;
+    res.end("ok");
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  baseUrl = `http://127.0.0.1:${server.address().port}`;
+});
+
+afterAll(async () => {
+  await new Promise((resolve) => server.close(resolve));
+});
+
+async function get(headers = {}) {
+  await fetch(baseUrl, { headers });
+  return seenHeaders;
+}
+
+describe("custom-server peer header sanitizing", () => {
+  it("generates a peer trust token at boot", () => {
+    expect(process.env.NINEROUTER_PEER_TOKEN).toMatch(/^[0-9a-f]{48}$/);
+  });
+
+  it("replaces a client-supplied x-9r-real-ip with the socket address", async () => {
+    const headers = await get({ "x-9r-real-ip": "203.0.113.55" });
+
+    expect(headers["x-9r-real-ip"]).toMatch(/^(::ffff:)?127\.0\.0\.1$/);
+  });
+
+  it("stamps the trust token so downstream can tell the wrapper ran", async () => {
+    const headers = await get();
+
+    expect(headers["x-9r-peer-token"]).toBe(process.env.NINEROUTER_PEER_TOKEN);
+  });
+
+  it("drops a client-supplied peer trust token", async () => {
+    const headers = await get({ "x-9r-peer-token": "forged-token" });
+
+    expect(headers["x-9r-peer-token"]).toBe(process.env.NINEROUTER_PEER_TOKEN);
+    expect(headers["x-9r-peer-token"]).not.toBe("forged-token");
+  });
+
+  it("drops a client-supplied x-9r-via-proxy marker", async () => {
+    const headers = await get({ "x-9r-via-proxy": "1" });
+
+    expect(headers["x-9r-via-proxy"]).toBeUndefined();
+  });
+
+  it("marks via-proxy and adopts the forwarded IP for a loopback proxy hop", async () => {
+    const headers = await get({ "x-forwarded-for": "203.0.113.9, 10.0.0.1" });
+
+    expect(headers["x-9r-via-proxy"]).toBe("1");
+    expect(headers["x-9r-real-ip"]).toBe("203.0.113.9");
+    expect(headers["x-forwarded-for"]).toBeUndefined();
+  });
+
+  // chat.js snapshots every client header into the request detail. Anything that grants
+  // access must not survive into a record the dashboard renders and cloud sync uploads.
+  it("keeps the peer token out of persisted request details", () => {
+    const sanitized = requestDetails.sanitizeHeaders({
+      "x-9r-peer-token": "secret",
+      "x-9r-cli-token": "secret",
+      "authorization": "Bearer sk-x",
+      "x-9r-real-ip": "127.0.0.1",
+    });
+
+    expect(sanitized["x-9r-peer-token"]).toBeUndefined();
+    expect(sanitized["x-9r-cli-token"]).toBeUndefined();
+    expect(sanitized["authorization"]).toBeUndefined();
+    expect(sanitized["x-9r-real-ip"]).toBe("127.0.0.1");
+  });
+});

tests/unit/dashboard-guard.test.js

@@ -35,6 +35,8 @@ vi.mock("@/lib/auth/dashboardSession", () => ({
 
 const { proxy, __test__ } = await import("../../src/dashboardGuard.js");
 
+const PEER_TOKEN = "peer-token-fixture";
+
 function request(pathname, headers = {}) {
   const normalizedHeaders = new Headers(headers);
   return {
@@ -45,9 +47,16 @@ function request(pathname, headers = {}) {
   };
 }
 
+// A request that actually came through custom-server.js: peer IP stamped from the TCP
+// socket and proven by the per-process secret.
+function localRequest(pathname, headers = {}) {
+  return request(pathname, { "x-9r-peer-token": PEER_TOKEN, "x-9r-real-ip": "127.0.0.1", ...headers });
+}
+
 describe("dashboard guard public LLM API access", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
     mocks.getSettings.mockResolvedValue({ requireLogin: true });
     mocks.validateApiKey.mockResolvedValue(false);
     mocks.getConsistentMachineId.mockResolvedValue("cli-token");
@@ -55,14 +64,14 @@ describe("dashboard guard public LLM API access", () => {
   });
 
   it("allows loopback public LLM API without API key", async () => {
-    const response = await proxy(request("/v1/chat/completions", { host: "localhost:20128" }));
+    const response = await proxy(localRequest("/v1/chat/completions", { host: "localhost:20128" }));
 
     expect(response).toBe(mocks.nextResponse);
     expect(mocks.validateApiKey).not.toHaveBeenCalled();
   });
 
   it("rejects remote Host-spoof when real peer IP is non-loopback", async () => {
-    const response = await proxy(request("/v1/chat/completions", {
+    const response = await proxy(localRequest("/v1/chat/completions", {
       host: "localhost",
       "x-9r-real-ip": "10.204.111.34",
     }));
@@ -72,7 +81,7 @@ describe("dashboard guard public LLM API access", () => {
   });
 
   it("allows loopback peer IP regardless of Host", async () => {
-    const response = await proxy(request("/v1/chat/completions", {
+    const response = await proxy(localRequest("/v1/chat/completions", {
       host: "localhost:20128",
       "x-9r-real-ip": "127.0.0.1",
     }));
@@ -89,7 +98,7 @@ describe("dashboard guard public LLM API access", () => {
   });
 
   it("allows loopback rewritten public LLM API without API key", async () => {
-    const response = await proxy(request("/api/v1/chat/completions", { host: "localhost:20128" }));
+    const response = await proxy(localRequest("/api/v1/chat/completions", { host: "localhost:20128" }));
 
     expect(response).toBe(mocks.nextResponse);
     expect(mocks.validateApiKey).not.toHaveBeenCalled();
@@ -191,6 +200,7 @@ describe("dashboard guard public LLM API access", () => {
 describe("dashboard guard local-only access", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
     mocks.getSettings.mockResolvedValue({ requireLogin: true });
     mocks.validateApiKey.mockResolvedValue(false);
     mocks.getConsistentMachineId.mockResolvedValue("cli-token");
@@ -207,7 +217,7 @@ describe("dashboard guard local-only access", () => {
   });
 
   it("rejects local-only route on loopback when requireLogin=true and no JWT", async () => {
-    const response = await proxy(request("/api/mcp/filesystem/sse", {
+    const response = await proxy(localRequest("/api/mcp/filesystem/sse", {
       host: "localhost:20128",
       origin: "http://localhost:20128",
     }));
@@ -219,7 +229,7 @@ describe("dashboard guard local-only access", () => {
   it("allows local-only route on loopback when requireLogin=false", async () => {
     mocks.getSettings.mockResolvedValue({ requireLogin: false });
 
-    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+    const response = await proxy(localRequest("/api/cli-tools/antigravity-mitm", {
       host: "localhost:20128",
       origin: "http://localhost:20128",
     }));
@@ -240,7 +250,7 @@ describe("dashboard guard local-only access", () => {
   it("rejects local-only route when Origin is non-loopback (CSRF block)", async () => {
     mocks.getSettings.mockResolvedValue({ requireLogin: false });
 
-    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+    const response = await proxy(localRequest("/api/cli-tools/antigravity-mitm", {
       host: "localhost:20128",
       origin: "http://evil.example.com",
     }));

tests/unit/local-request-peer-trust-3294.test.js

@@ -0,0 +1,211 @@
+// GHSA-pjm4-8fpg-f9p6 (#3294): `next start` leaves custom-server.js out of the request
+// path, so x-9r-real-ip arrives straight from the client and a remote caller can claim to
+// be loopback. Host is spoofable the same way, so it cannot be the production fallback.
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  nextResponse: Symbol("next"),
+  jsonResponse: vi.fn((body, init) => ({ status: init?.status || 200, body })),
+  getSettings: vi.fn(),
+  validateApiKey: vi.fn(),
+  getConsistentMachineId: vi.fn(),
+  verifyDashboardAuthToken: vi.fn(),
+}));
+
+vi.mock("next/server", () => ({
+  NextResponse: {
+    next: vi.fn(() => mocks.nextResponse),
+    json: mocks.jsonResponse,
+    redirect: vi.fn((url) => ({ status: 307, url })),
+  },
+}));
+
+vi.mock("@/lib/localDb", () => ({
+  getSettings: mocks.getSettings,
+  validateApiKey: mocks.validateApiKey,
+}));
+
+vi.mock("@/shared/utils/machineId", () => ({
+  getConsistentMachineId: mocks.getConsistentMachineId,
+}));
+
+vi.mock("@/lib/auth/dashboardSession", () => ({
+  verifyDashboardAuthToken: mocks.verifyDashboardAuthToken,
+}));
+
+const { proxy } = await import("../../src/dashboardGuard.js");
+const { getClientIp } = await import("../../src/lib/auth/loginLimiter.js");
+
+const PEER_TOKEN = "peer-token-fixture";
+
+function request(pathname, headers = {}) {
+  return {
+    nextUrl: { pathname, searchParams: new URL(`http://localhost${pathname}`).searchParams },
+    headers: new Headers(headers),
+    cookies: { get: vi.fn(() => undefined) },
+    url: `http://localhost${pathname}`,
+  };
+}
+
+const originalNodeEnv = process.env.NODE_ENV;
+
+describe("peer header trust", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
+    process.env.NODE_ENV = "production";
+    mocks.getSettings.mockResolvedValue({ requireLogin: true });
+    mocks.validateApiKey.mockResolvedValue(false);
+    mocks.getConsistentMachineId.mockResolvedValue("cli-token");
+    mocks.verifyDashboardAuthToken.mockResolvedValue(false);
+  });
+
+  afterEach(() => {
+    process.env.NODE_ENV = originalNodeEnv;
+    delete process.env.NINEROUTER_PEER_TOKEN;
+  });
+
+  it("rejects a spoofed loopback peer IP that carries no trust proof", async () => {
+    const response = await proxy(request("/api/v1/models", {
+      host: "172.18.192.1:20140",
+      "x-9r-real-ip": "127.0.0.1",
+    }));
+
+    expect(response.status).toBe(401);
+    expect(response.body.error).toBe("API key required for remote API access");
+  });
+
+  it("rejects a spoofed loopback peer IP carrying a wrong trust token", async () => {
+    const response = await proxy(request("/api/v1/models", {
+      host: "172.18.192.1:20140",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-peer-token": "guessed-token",
+    }));
+
+    expect(response.status).toBe(401);
+  });
+
+  it("rejects a spoofed loopback Host in production", async () => {
+    const response = await proxy(request("/api/v1/models", { host: "localhost" }));
+
+    expect(response.status).toBe(401);
+  });
+
+  it("rejects a spoofed loopback peer IP when the wrapper never booted", async () => {
+    delete process.env.NINEROUTER_PEER_TOKEN;
+
+    const response = await proxy(request("/api/v1/models", {
+      host: "172.18.192.1:20140",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-peer-token": "any-token",
+    }));
+
+    expect(response.status).toBe(401);
+  });
+
+  it("keeps serving a genuinely local request stamped by the wrapper", async () => {
+    const response = await proxy(request("/api/v1/models", {
+      host: "localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-peer-token": PEER_TOKEN,
+    }));
+
+    expect(response).toBe(mocks.nextResponse);
+    expect(mocks.validateApiKey).not.toHaveBeenCalled();
+  });
+
+  // A dual-stack listener reports loopback as ::ffff:127.0.0.1, which the old
+  // split-on-first-colon check reduced to "".
+  it.each(["::ffff:127.0.0.1", "::1", "[::1]", "127.0.0.1", "::FFFF:127.0.0.1"])(
+    "treats %s as a loopback peer",
+    async (peerIp) => {
+      const response = await proxy(request("/api/v1/models", {
+        host: "localhost:20128",
+        "x-9r-real-ip": peerIp,
+        "x-9r-peer-token": PEER_TOKEN,
+      }));
+
+      expect(response).toBe(mocks.nextResponse);
+    }
+  );
+
+  it.each(["::ffff:10.204.111.34", "2001:db8::1", "[2001:db8::1]", "10.204.111.34"])(
+    "refuses %s as a peer",
+    async (peerIp) => {
+      const response = await proxy(request("/api/v1/models", {
+        host: "localhost:20128",
+        "x-9r-real-ip": peerIp,
+        "x-9r-peer-token": PEER_TOKEN,
+      }));
+
+      expect(response.status).toBe(401);
+    }
+  );
+
+  it("still refuses a stamped non-loopback peer IP", async () => {
+    const response = await proxy(request("/api/v1/models", {
+      host: "localhost:20128",
+      "x-9r-real-ip": "10.204.111.34",
+      "x-9r-peer-token": PEER_TOKEN,
+    }));
+
+    expect(response.status).toBe(401);
+  });
+
+  it("blocks spoofed local-only routes that would otherwise spawn processes", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+
+    const response = await proxy(request("/api/mcp/filesystem/sse", {
+      host: "172.18.192.1:20140",
+      "x-9r-real-ip": "127.0.0.1",
+    }));
+
+    expect(response.status).toBe(403);
+    expect(response.body.error).toBe("Local only: CLI token required");
+  });
+
+  it("accepts the legacy Host fallback only in development", async () => {
+    process.env.NODE_ENV = "development";
+
+    const response = await proxy(request("/api/v1/models", { host: "localhost:20127" }));
+
+    expect(response).toBe(mocks.nextResponse);
+  });
+});
+
+describe("login limiter client IP", () => {
+  beforeEach(() => {
+    process.env.NINEROUTER_PEER_TOKEN = PEER_TOKEN;
+    delete process.env.TRUST_PROXY;
+  });
+
+  afterEach(() => {
+    delete process.env.NINEROUTER_PEER_TOKEN;
+    delete process.env.TRUST_PROXY;
+  });
+
+  it("buckets spoofed peer IPs together so lockout cannot be rotated away", () => {
+    const first = getClientIp(request("/api/auth/login", { "x-9r-real-ip": "1.1.1.1" }));
+    const second = getClientIp(request("/api/auth/login", { "x-9r-real-ip": "2.2.2.2" }));
+
+    expect(first).toBe("unknown");
+    expect(second).toBe("unknown");
+  });
+
+  it("keys on the stamped peer IP when the wrapper proved it", () => {
+    const ip = getClientIp(request("/api/auth/login", {
+      "x-9r-real-ip": "203.0.113.9",
+      "x-9r-peer-token": PEER_TOKEN,
+    }));
+
+    expect(ip).toBe("203.0.113.9");
+  });
+
+  it("still honours TRUST_PROXY for operators fronting 9router with a reverse proxy", () => {
+    process.env.TRUST_PROXY = "true";
+
+    const ip = getClientIp(request("/api/auth/login", { "x-forwarded-for": "198.51.100.7, 10.0.0.1" }));
+
+    expect(ip).toBe("198.51.100.7");
+  });
+});

tests/unit/standalone-assets.test.js

@@ -37,6 +37,17 @@ describe("standalone build assets", () => {
       .toBe("static asset");
   });
 
+  // Without the wrapper beside server.js nothing can prove a request is local.
+  it("copies the request-sanitizing server wrapper into the standalone output", () => {
+    const projectRoot = createBuildFixture(".next");
+    writeFileSync(join(projectRoot, "custom-server.js"), "wrapper");
+
+    copyStandaloneAssets({ projectRoot, distDir: ".next" });
+
+    expect(readFileSync(join(projectRoot, ".next", "standalone", "custom-server.js"), "utf8"))
+      .toBe("wrapper");
+  });
+
   it("does not modify workspace-traced CLI builds", () => {
     const projectRoot = createBuildFixture(".next-cli-build");
     const previousMode = process.env.NEXT_TRACING_ROOT_MODE;