d0e01d2863
Behind a reverse proxy with a custom port (e.g. Caddy on :3443), the browser sends an Origin header that includes the port, but the board mutation guard only read the Host header which often omits the port. This caused a 403 "Board mutation requires trusted browser origin" for self-hosted deployments behind reverse proxies. Read x-forwarded-host (first value, comma-split) with the same pattern already used in private-hostname-guard.ts and routes/access.ts. Fixes #1734
67 lines
1.9 KiB
TypeScript
67 lines
1.9 KiB
TypeScript
import type { Request, RequestHandler } from "express";
|
|
|
|
const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
|
|
const DEFAULT_DEV_ORIGINS = [
|
|
"http://localhost:3100",
|
|
"http://127.0.0.1:3100",
|
|
];
|
|
|
|
function parseOrigin(value: string | undefined) {
|
|
if (!value) return null;
|
|
try {
|
|
const url = new URL(value);
|
|
return `${url.protocol}//${url.host}`.toLowerCase();
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function trustedOriginsForRequest(req: Request) {
|
|
const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
|
|
const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
|
|
const host = forwardedHost || req.header("host")?.trim();
|
|
if (host) {
|
|
origins.add(`http://${host}`.toLowerCase());
|
|
origins.add(`https://${host}`.toLowerCase());
|
|
}
|
|
return origins;
|
|
}
|
|
|
|
function isTrustedBoardMutationRequest(req: Request) {
|
|
const allowedOrigins = trustedOriginsForRequest(req);
|
|
const origin = parseOrigin(req.header("origin"));
|
|
if (origin && allowedOrigins.has(origin)) return true;
|
|
|
|
const refererOrigin = parseOrigin(req.header("referer"));
|
|
if (refererOrigin && allowedOrigins.has(refererOrigin)) return true;
|
|
|
|
return false;
|
|
}
|
|
|
|
export function boardMutationGuard(): RequestHandler {
|
|
return (req, res, next) => {
|
|
if (SAFE_METHODS.has(req.method.toUpperCase())) {
|
|
next();
|
|
return;
|
|
}
|
|
|
|
if (req.actor.type !== "board") {
|
|
next();
|
|
return;
|
|
}
|
|
|
|
// Local-trusted mode and board bearer keys are not browser-session requests.
|
|
// In these modes, origin/referer headers can be absent; do not block those mutations.
|
|
if (req.actor.source === "local_implicit" || req.actor.source === "board_key") {
|
|
next();
|
|
return;
|
|
}
|
|
|
|
if (!isTrustedBoardMutationRequest(req)) {
|
|
res.status(403).json({ error: "Board mutation requires trusted browser origin" });
|
|
return;
|
|
}
|
|
|
|
next();
|
|
};
|
|
}
|