yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(invitations): throttle unauthenticated invitation lookups and harden redirects

Browse Source 
The invitation preview surfaces (/invitations/accept and /register?invitationToken=) are the
only unauthenticated reads of invitation data, and each render costs two database queries.
They are now rate limited before the lookup can touch the database: a generous per-IP bucket
that bounds enumeration across tokens, plus a tight per-IP+token bucket that stops repeated
probing of a single invitation. Tokens are hashed before they reach the rate_limits table.

A throttled lookup says so ("we couldn't check this invitation right now") instead of claiming
the invitation is invalid, and signed-in acceptance is not gated by it.

The callback sanitizer also checked only the origin, which is not enough: an attacker can
smuggle a host into the path of an otherwise same-origin URL — new URL('https://app/​/evil.com')
keeps our origin but yields a pathname of //evil.com, which navigation sinks resolve as
protocol-relative and follow off-site. Paths are now required to be rooted at a single slash,
and the login redirect re-checks at the sink.

getClientIp is split so server components that only have `await headers()` resolve the client
IP through the same trusted-proxy logic as route handlers.
This commit is contained in:
yusufipk
2026-07-25 19:39:16 +07:00
parent 9c75ce91e1
commit b1aed03fca
8 changed files with 108 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/invitations/accept/page.tsx
+12 -2
View File
@@ -2,7 +2,12 @@ import { redirect } from 'next/navigation';
import { auth } from '@/lib/auth';
import { db } from '@/lib/db';
import { acceptInvitationTokenForUser, getInvitationPreviewByToken } from '@/lib/invitations';
import { InvitationAccountMismatch, InvitationLanding } from './invitation-landing';
import { isInvitationPreviewAllowed } from '@/lib/invitation-preview-limit';
import {
InvitationAccountMismatch,
InvitationLanding,
InvitationRateLimited,
} from './invitation-landing';
interface InvitationAcceptPageProps {
searchParams: Promise<{
@@ -21,7 +26,12 @@ export default async function InvitationAcceptPage({ searchParams }: InvitationA
const session = await auth();
if (!session?.user?.id) {
// Signed-out visitors get the invitation itself instead of a bare login form:
// most of them have no account yet and need to be told to create one.
// most of them have no account yet and need to be told to create one. This is the
// only unauthenticated read of invitation data, so it is IP-throttled.
if (!(await isInvitationPreviewAllowed(token))) {
return <InvitationRateLimited />;
}
const preview = await getInvitationPreviewByToken(token);
return <InvitationLanding token={token} preview={preview} />;
}