syntaxbullet/minabot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: support Discord sign-in behind a trusted TLS proxy

Browse Source
This commit is contained in:
syntaxbullet
2026-09-07 11:50:22 +02:00
parent c7aa5a1c65
commit 50d7838de3
4 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/auth/index.ts
View File

@@ -75,7 +75,11 @@ export function createAuth(db: AppDatabase, config: AuthConfig, request: FetchDi
routes.get("/discord", async c => {
if (!isAuthConfigured(config)) return c.redirect("/?auth_error=not_configured");
// Use one configured origin for redirects and cookie ownership.
if (new URL(c.req.url).origin !== config.origin) return c.redirect(`${config.origin}/api/auth/discord?${new URLSearchParams({ timezone: normalizeTimezone(c.req.query("timezone")) })}`);
const requestUrl = new URL(c.req.url);
// Enable only behind a private proxy that overwrites X-Forwarded-Proto.
// Keep the actual Host; never trust a client-supplied forwarded hostname.
if (config.trustProxy && c.req.header("X-Forwarded-Proto") === "https") requestUrl.protocol = "https:";
if (requestUrl.origin !== config.origin) return c.redirect(`${config.origin}/api/auth/discord?${new URLSearchParams({ timezone: normalizeTimezone(c.req.query("timezone")) })}`);
const state = randomToken();
await setSignedCookie(c, stateName, JSON.stringify({
state,