Changeset 5b1115b in Klonkt for src/views/shell.ejs

Timestamp:

06/28/2026 11:48:20 AM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

89cc8c4

Parents:

4fdbbe6

Message:

fix(csrf): accept PUBLIC_BASE_URL host + X-Forwarded-Host in same-origin check

Behind a reverse proxy that doesn't preserve the Host (e.g. Apache .htaccess [P] proxying →
backend sees Host: localhost:3000), the same-origin CSRF check rejected every POST because it
compared Origin (the real domain) to the raw Host. Now it also accepts the operator-configured
PUBLIC_BASE_URL host and the proxy's X-Forwarded-Host — both operator/proxy-controlled, not
forgeable via a victim's browser. Makes Klonkt work behind common Apache/.htaccess setups.

(No files)