7648c3412b
- Add custom-server.js: inject unspoofable socket IP, strip client XFF (wired into Docker CMD + CLI spawn + build-cli copy) - loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback - Force password change on first remote login while default is in use - Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite - CLI settings: reset via API instead of stale db.json - Fix OAuth modals opening duplicate browser tabs on add-connection - Add cli:pack / cli:publish scripts Co-authored-by: Cursor <cursoragent@cursor.com>
23 lines
858 B
JavaScript
23 lines
858 B
JavaScript
const http = require("http");
|
|
|
|
const origCreate = http.createServer.bind(http);
|
|
|
|
// Wrap Next standalone HTTP server: derive client IP from the TCP socket
|
|
// (unspoofable) and strip client-supplied forwarding headers so downstream
|
|
// rate-limiting keys on the real peer address instead of attacker-controlled XFF.
|
|
http.createServer = (...args) => {
|
|
const handler = args.find((a) => typeof a === "function");
|
|
const rest = args.filter((a) => typeof a !== "function");
|
|
if (!handler) return origCreate(...args);
|
|
const wrapped = (req, res) => {
|
|
const ip = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
|
|
delete req.headers["x-9r-real-ip"];
|
|
delete req.headers["x-forwarded-for"];
|
|
req.headers["x-9r-real-ip"] = ip;
|
|
return handler(req, res);
|
|
};
|
|
return origCreate(...rest, wrapped);
|
|
};
|
|
|
|
require("./server.js");
|