Nguyen Thanh Dat
92259214db
fix(security): require proof that x-9r-real-ip came from the socket (GHSA-pjm4-8fpg-f9p6)
...
x-9r-real-ip and the Host fallback were trusted from client-controlled
headers whenever custom-server.js was not in the request path (npm run
start, start:bun), letting a remote caller pose as local to skip API key
auth and reach LOCAL_ONLY_PATHS (/api/mcp/*, /api/tunnel/enable,
/api/auth/reset-password).
custom-server.js now generates a per-process secret at boot and stamps it
as x-9r-peer-token on every request it sanitizes. hasTrustedPeerHeaders()
(src/lib/auth/trustedPeer.js) gates trust in x-9r-real-ip on that secret;
otherwise the guard falls back to Host only in development, and fails
closed in production. Same gate on loginLimiter.getClientIp() so a spoofed
header cannot rotate the login lockout bucket.
Also: fix isLoopbackHostname for IPv6 (::1, ::ffff:127.0.0.1) which the
old split(":")[0] reduced to empty string; route npm run start /
start:bun through custom-server.js (postbuild copies it into
.next/standalone, build-cli.js fails without it) so documented deployments
keep passwordless local access.
2026-08-14 16:33:58 +07:00
..
2026-08-14 16:32:54 +07:00
2026-06-29 15:29:49 +07:00
2026-07-19 16:29:55 +07:00
2026-06-06 10:48:14 +07:00
2026-06-14 13:15:48 +07:00
2026-08-05 13:21:38 +07:00
2026-08-14 16:27:10 +07:00
2026-07-23 16:34:24 +07:00
2026-07-29 19:30:44 +07:00
2026-07-08 10:17:47 +07:00
2026-08-05 10:27:27 +07:00
2026-08-02 09:34:27 +07:00
2026-06-26 17:19:46 +07:00
2026-05-16 10:54:41 +07:00
2026-07-07 12:02:56 +07:00
2026-07-16 17:20:10 +07:00
2026-07-03 15:18:27 +07:00
2026-07-03 15:18:27 +07:00
2026-07-29 19:34:14 +07:00
2026-06-18 09:13:27 +07:00
2026-07-29 19:34:14 +07:00
2026-07-07 11:55:45 +07:00
2026-06-06 12:54:01 +07:00
2026-08-05 11:32:14 +07:00
2026-08-05 11:54:16 +07:00
2026-07-16 15:29:52 +07:00
2026-06-29 15:22:47 +07:00
2026-06-26 10:51:16 +07:00
2026-08-05 11:39:59 +07:00
2026-06-15 18:18:04 +07:00
2026-08-05 11:39:59 +07:00
2026-08-05 16:17:26 +07:00
2026-07-03 15:07:45 +07:00
2026-06-26 10:37:29 +07:00
2026-06-15 18:18:04 +07:00
2026-06-20 15:19:31 +07:00
2026-05-01 16:36:36 +07:00
2026-06-14 18:49:38 +07:00
2026-07-03 15:18:27 +07:00
2026-08-05 13:27:25 +07:00
2026-07-07 12:06:09 +07:00
2026-07-29 19:29:27 +07:00
2026-07-20 15:39:55 +07:00
2026-05-21 09:52:30 +07:00
2026-07-20 15:39:55 +07:00
2026-08-05 10:32:32 +07:00
2026-08-14 16:33:58 +07:00
2026-08-14 16:33:58 +07:00
2026-05-09 17:48:20 +07:00
2026-05-09 17:48:20 +07:00
2026-05-09 22:48:07 +07:00
2026-05-09 17:48:20 +07:00
2026-07-10 11:29:12 +07:00
2026-07-29 18:09:35 +07:00
2026-07-29 18:10:03 +07:00
2026-07-23 16:07:57 +07:00
2026-06-13 10:54:51 +07:00
2026-06-15 11:38:43 +07:00
2026-07-23 16:28:37 +07:00
2026-06-15 18:18:04 +07:00
2026-06-15 11:38:43 +07:00
2026-08-14 16:21:11 +07:00
2026-06-26 10:37:23 +07:00
2026-08-13 11:56:43 +07:00
2026-08-14 16:27:10 +07:00
2026-07-23 16:34:24 +07:00
2026-06-26 10:50:13 +07:00
2026-06-26 10:32:34 +07:00
2026-05-26 11:23:47 +07:00
2026-08-05 11:00:40 +07:00
2026-05-29 15:40:42 +07:00
2026-07-19 13:35:38 +07:00
2026-07-16 15:33:19 +07:00
2026-07-16 12:00:14 +07:00
2026-07-16 15:33:19 +07:00
2026-07-10 11:47:08 +07:00
2026-07-29 18:09:43 +07:00
2026-08-05 11:43:40 +07:00
2026-07-16 11:27:42 +07:00
2026-07-10 17:32:45 +07:00
2026-06-29 15:59:21 +07:00
2026-08-05 11:32:38 +07:00
2026-08-13 18:30:44 +07:00
2026-06-02 21:14:36 +08:00
2026-06-15 18:18:04 +07:00
2026-06-13 10:54:51 +07:00
2026-07-23 16:28:37 +07:00
2026-07-03 10:58:31 +07:00
2026-07-03 11:11:07 +07:00
2026-07-29 21:05:23 +07:00
2026-07-29 19:27:41 +07:00
2026-07-29 19:27:41 +07:00
2026-06-26 11:42:05 +07:00
2026-08-13 11:56:31 +07:00
2026-07-20 10:55:33 +07:00
2026-07-29 19:27:41 +07:00
2026-07-20 10:55:33 +07:00
2026-07-20 10:55:33 +07:00
2026-08-13 11:33:41 +07:00
2026-08-14 16:33:58 +07:00
2026-06-21 16:51:47 +07:00
2026-06-13 11:43:18 +07:00
2026-05-13 15:34:10 +07:00
2026-06-06 10:01:05 +07:00
2026-05-13 15:34:10 +07:00
2026-07-01 09:30:52 +07:00
2026-06-15 18:18:04 +07:00
2026-07-05 17:34:04 +07:00
2026-06-18 09:10:52 +07:00
2026-06-03 01:53:34 +08:00
2026-06-14 18:49:38 +07:00
2026-08-02 09:34:27 +07:00
2026-08-05 10:38:25 +07:00
2026-08-05 13:27:25 +07:00
2026-08-05 13:27:25 +07:00
2026-08-13 11:40:45 +07:00
2026-07-16 15:33:19 +07:00
2026-08-05 13:27:25 +07:00
2026-06-29 16:05:29 +07:00
2026-05-26 11:33:38 +07:00
2026-07-10 11:11:37 +07:00
2026-06-06 12:54:01 +07:00
2026-06-14 18:49:38 +07:00
2026-07-23 16:27:06 +07:00
2026-06-15 11:38:43 +07:00
2026-06-20 15:09:11 +07:00
2026-07-07 11:57:04 +07:00
2026-04-22 11:58:53 +07:00
2026-08-13 11:56:43 +07:00
2026-06-15 18:18:04 +07:00
2026-06-20 15:19:22 +07:00
2026-08-05 13:13:54 +07:00
2026-06-06 10:01:05 +07:00
2026-06-15 11:38:43 +07:00
2026-07-04 23:26:49 +07:00
2026-06-02 21:14:36 +08:00
2026-06-26 12:06:35 +07:00
2026-07-10 16:10:42 +07:00
2026-08-13 11:43:11 +07:00
2026-08-13 11:43:11 +07:00
2026-07-16 12:09:48 +07:00
2026-06-06 12:25:12 +07:00
2026-08-13 11:50:25 +07:00
2026-07-10 13:08:58 +07:00
2026-06-06 16:07:43 +07:00
2026-08-13 11:46:49 +07:00
2026-04-22 15:36:51 +07:00
2026-04-22 15:36:51 +07:00
2026-07-07 12:02:56 +07:00
2026-07-09 15:12:52 +07:00
2026-05-17 15:13:37 +07:00
2026-08-13 17:56:34 +07:00
2026-08-13 11:50:25 +07:00
2026-07-10 11:29:06 +07:00
2026-06-26 11:04:51 +07:00
2026-07-16 15:15:05 +07:00
2026-08-14 16:33:58 +07:00
2026-07-09 15:13:24 +07:00
2026-08-05 11:39:59 +07:00
2026-07-23 16:27:06 +07:00
2026-06-13 21:32:52 +07:00
2026-08-05 16:17:26 +07:00
2026-06-26 17:22:02 +07:00
2026-06-14 18:49:38 +07:00
2026-06-14 18:49:38 +07:00
2026-07-23 16:22:47 +07:00
2026-06-15 11:38:43 +07:00
2026-08-05 16:17:26 +07:00
2026-06-26 11:37:44 +07:00
2026-04-22 11:58:53 +07:00
2026-07-25 17:25:19 +07:00
2026-05-21 11:33:18 +07:00
2026-05-21 11:33:18 +07:00
2026-07-16 15:29:52 +07:00
2026-07-16 15:29:52 +07:00
2026-08-05 11:46:23 +07:00