yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(request-origin): remove unused origin retrieval functions to enhance security

Browse Source
This commit is contained in:
Yusuf İpek
2026-04-10 21:45:40 +03:00
parent 72bdc05422
commit 9b561b78b4
1 changed files with 4 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/request-origin.ts
+4 -25
View File
@@ -16,35 +16,14 @@ function getConfiguredOrigins(): string[] {
.filter((value): value is string => value !== null);
}
function getForwardedOrigin(request: NextRequest): string | null {
const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();
const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim();
if (!forwardedProto || !forwardedHost) return null;
return normalizeOrigin(`${forwardedProto}://${forwardedHost}`);
}
function getHostHeaderOrigin(request: NextRequest): string | null {
const host = request.headers.get('host')?.split(',')[0]?.trim();
if (!host) return null;
const forwardedProto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();
const protocol = forwardedProto || request.nextUrl.protocol.replace(':', '');
if (!protocol) return null;
return normalizeOrigin(`${protocol}://${host}`);
}
export function getAllowedRequestOrigins(request: NextRequest): Set<string> {
const origins = new Set<string>();
// Only trust server-side computed origin and operator-configured origins.
// x-forwarded-host / x-forwarded-proto are client-controlled and must never
// be used to build the allowed-origin set (SSRF / origin-spoof vector).
origins.add(request.nextUrl.origin);
const forwardedOrigin = getForwardedOrigin(request);
if (forwardedOrigin) origins.add(forwardedOrigin);
const hostHeaderOrigin = getHostHeaderOrigin(request);
if (hostHeaderOrigin) origins.add(hostHeaderOrigin);
for (const configuredOrigin of getConfiguredOrigins()) {
origins.add(configuredOrigin);
}