92259214db
x-9r-real-ip and the Host fallback were trusted from client-controlled
headers whenever custom-server.js was not in the request path (npm run
start, start:bun), letting a remote caller pose as local to skip API key
auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable,
/api/auth/reset-password).
custom-server.js now generates a per-process secret at boot and stamps it
as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders()
(src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret;
otherwise the guard falls back to Host only in development, and fails
closed in production. Same gate on loginLimiter.getClientIp() so a spoofed
header cannot rotate the login lockout bucket.
Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the
old split(":")[0] reduced to empty string; route npm run start /
start:bun through custom-server.js (postbuild copies it into
.next/standalone, build-cli.js fails without it) so documented deployments
keep passwordless local access.
66 lines
2.0 KiB
JSON
66 lines
2.0 KiB
JSON
{
|
|
"name": "9router-app",
|
|
"version": "0.5.50",
|
|
"description": "9Router web dashboard",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev --port 20127",
|
|
"dev:webpack": "next dev --webpack --port 20127",
|
|
"build": "next build --webpack",
|
|
"postbuild": "node scripts/copy-standalone-assets.mjs",
|
|
"postbuild:bun": "node scripts/copy-standalone-assets.mjs",
|
|
"start": "node custom-server.js --port 20127",
|
|
"dev:bun": "bun --bun next dev --webpack --port 20127",
|
|
"build:bun": "bun --bun next build --webpack",
|
|
"start:bun": "bun ./.next/standalone/custom-server.js",
|
|
"cli:pack": "npm --prefix cli run pack:cli",
|
|
"cli:publish": "npm --prefix cli run publish:cli"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/modifiers": "^9.0.0",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@monaco-editor/react": "^4.7.0",
|
|
"@next/third-parties": "^16.2.9",
|
|
"@node-saml/node-saml": "^5.1.0",
|
|
"@xyflow/react": "^12.10.1",
|
|
"bcryptjs": "^3.0.3",
|
|
"chalk": "^5.6.2",
|
|
"confbox": "^0.2.4",
|
|
"express": "^5.2.1",
|
|
"http-proxy-middleware": "^3.0.5",
|
|
"jose": "^6.1.3",
|
|
"marked": "^18.0.1",
|
|
"material-symbols": "^0.44.6",
|
|
"monaco-editor": "^0.55.1",
|
|
"next": "^16.1.6",
|
|
"node-forge": "^1.3.3",
|
|
"node-machine-id": "^1.1.12",
|
|
"open": "^11.0.0",
|
|
"ora": "^9.1.0",
|
|
"prop-types": "^15.8.1",
|
|
"react": "19.2.4",
|
|
"react-dom": "19.2.4",
|
|
"react-is": "^16.13.1",
|
|
"recharts": "^3.7.0",
|
|
"selfsigned": "^5.5.0",
|
|
"socks-proxy-agent": "^8.0.5",
|
|
"sql.js": "^1.14.1",
|
|
"undici": "^7.19.2",
|
|
"uuid": "^13.0.0",
|
|
"zustand": "^5.0.10"
|
|
},
|
|
"optionalDependencies": {
|
|
"better-sqlite3": "^12.6.2"
|
|
},
|
|
"comment_better_sqlite3": "kept in optionalDependencies so npm install doesn't fail on systems without build tools — sql.js is used as fallback at runtime",
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4.1.18",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.1.6",
|
|
"postcss": "^8.5.6",
|
|
"tailwindcss": "^4"
|
|
}
|
|
}
|