mirror of
https://github.com/saltbo/zpan.git
synced 2026-10-31 02:41:33 +08:00
saltboandClaude Fable 5
e56d3dc61a
Sign-in via 127.0.0.1 or a LAN IP failed with "Invalid origin" unless the user manually configured TRUSTED_ORIGINS. better-auth's trustedOrigins now uses the function form: origins on localhost, 127.0.0.0/8, ::1, or RFC 1918 private ranges are trusted per request. Browsers set the Origin header themselves, so a private address in it proves the page was served from the user's own machine or LAN — safe to trust for CSRF purposes. Also set advanced.disableOriginCheck: false explicitly: better-auth silently disables the origin check under NODE_ENV=test, so no test ever exercised real CSRF behavior. Test helpers now send an Origin header on cookie-bearing requests, like real browsers do. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
36 lines
1.0 KiB
TypeScript
36 lines
1.0 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { isLocalNetworkOrigin } from './local-origin'
|
|
|
|
describe('isLocalNetworkOrigin', () => {
|
|
it.each([
|
|
'http://localhost:5185',
|
|
'http://app.localhost:3000',
|
|
'http://127.0.0.1:5185',
|
|
'http://127.8.8.8',
|
|
'http://[::1]:5185',
|
|
'http://10.0.0.5:8080',
|
|
'http://172.16.0.1',
|
|
'http://172.31.255.254:443',
|
|
'http://192.168.1.100:5185',
|
|
'https://192.168.1.100',
|
|
])('trusts %s', (origin) => {
|
|
expect(isLocalNetworkOrigin(origin)).toBe(true)
|
|
})
|
|
|
|
it.each([
|
|
'http://example.com',
|
|
'https://zpan.example.com',
|
|
'http://11.0.0.1', // public, adjacent to 10/8
|
|
'http://172.32.0.1', // outside 172.16/12
|
|
'http://192.169.0.1', // outside 192.168/16
|
|
'http://10.evil.com', // domain that merely starts with a private prefix
|
|
'http://192.168.1.1.evil.com',
|
|
'ftp://127.0.0.1', // non-http(s) scheme
|
|
'null',
|
|
'not a url',
|
|
'',
|
|
])('rejects %s', (origin) => {
|
|
expect(isLocalNetworkOrigin(origin)).toBe(false)
|
|
})
|
|
})
|