From 9b561b78b44e23a366fdec68606e3190f535792f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20=C4=B0pek?= <yusufipek@protonmail.com>
Date: Fri, 10 Apr 2026 21:45:40 +0300
Subject: [PATCH] refactor(request-origin): remove unused origin retrieval
 functions to enhance security

---
 lib/request-origin.ts | 29 ++++-------------------------
 1 file changed, 4 insertions(+), 25 deletions(-)

diff --git a/lib/request-origin.ts b/lib/request-origin.ts
index 0bff1ff..edd9708 100644
--- a/lib/request-origin.ts
+++ b/lib/request-origin.ts
@@ -16,35 +16,14 @@ function getConfiguredOrigins(): string[] {
     .filter((value): value is string => value !== null);
 }
 
-function getForwardedOrigin(request: NextRequest): string | null {
-  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();
-  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();
-
-  if (!forwardedProto || !forwardedHost) return null;
-  return normalizeOrigin(`${forwardedProto}://${forwardedHost}`);
-}
-
-function getHostHeaderOrigin(request: NextRequest): string | null {
-  const host = request.headers.get('host')?.split(',')[0]?.trim();
-  if (!host) return null;
-
-  const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();
-  const protocol = forwardedProto || request.nextUrl.protocol.replace(':', '');
-  if (!protocol) return null;
-
-  return normalizeOrigin(`${protocol}://${host}`);
-}
-
 export function getAllowedRequestOrigins(request: NextRequest): Set<string> {
   const origins = new Set<string>();
+
+  // Only trust server-side computed origin and operator-configured origins.
+  // x-forwarded-host / x-forwarded-proto are client-controlled and must never
+  // be used to build the allowed-origin set (SSRF / origin-spoof vector).
   origins.add(request.nextUrl.origin);
 
-  const forwardedOrigin = getForwardedOrigin(request);
-  if (forwardedOrigin) origins.add(forwardedOrigin);
-
-  const hostHeaderOrigin = getHostHeaderOrigin(request);
-  if (hostHeaderOrigin) origins.add(hostHeaderOrigin);
-
   for (const configuredOrigin of getConfiguredOrigins()) {
     origins.add(configuredOrigin);
   }