fix(auth): reject spoofed local host headers

packages/web/server/lib/opencode/core-routes.test.js

@@ -700,4 +700,14 @@ describe('client auth routes', () => {
 
     expect(dependencies.uiAuthController.handlePasskeyStatus).toHaveBeenCalledTimes(1);
   });
+
+  it('does not trust a private Host header from a public socket peer', () => {
+    const tunnelAuthController = createTunnelAuth();
+    tunnelAuthController.setActiveTunnel({ tunnelId: 'tunnel-1', publicUrl: 'https://tunnel.example.com' });
+
+    expect(tunnelAuthController.classifyRequestScope({
+      headers: { host: '192.168.1.5:57123' },
+      socket: { remoteAddress: '203.0.113.10' },
+    })).toBe('unknown-public');
+  });
 });

packages/web/server/lib/opencode/tunnel-auth.js

@@ -172,19 +172,10 @@ const isLocalHost = (host, req) => {
     return false;
   }
 
-  if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') {
-    return true;
-  }
-
-  if (isPrivateOrLoopbackIp(host)) {
-    return true;
-  }
-
-  if (host === 'host.docker.internal') {
-    return isPrivateOrLoopbackIp(getSocketRemoteIp(req));
-  }
-
-  return false;
+  const isLocalHostname = host === 'localhost'
+    || host === 'host.docker.internal'
+    || isPrivateOrLoopbackIp(host);
+  return isLocalHostname && isPrivateOrLoopbackIp(getSocketRemoteIp(req));
 };
 
 const getClientIp = (req) => {