From a8953ad6f9d22e786d1088d55841d1aee45233da Mon Sep 17 00:00:00 2001 From: Bohdan Triapitsyn Date: Sun, 12 Jul 2026 00:46:41 +0300 Subject: [PATCH] fix(auth): reject spoofed local host headers --- .../web/server/lib/opencode/core-routes.test.js | 10 ++++++++++ packages/web/server/lib/opencode/tunnel-auth.js | 17 ++++------------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/packages/web/server/lib/opencode/core-routes.test.js b/packages/web/server/lib/opencode/core-routes.test.js index 761024eb..3119135e 100644 --- a/packages/web/server/lib/opencode/core-routes.test.js +++ b/packages/web/server/lib/opencode/core-routes.test.js @@ -700,4 +700,14 @@ describe('client auth routes', () => { expect(dependencies.uiAuthController.handlePasskeyStatus).toHaveBeenCalledTimes(1); }); + + it('does not trust a private Host header from a public socket peer', () => { + const tunnelAuthController = createTunnelAuth(); + tunnelAuthController.setActiveTunnel({ tunnelId: 'tunnel-1', publicUrl: 'https://tunnel.example.com' }); + + expect(tunnelAuthController.classifyRequestScope({ + headers: { host: '192.168.1.5:57123' }, + socket: { remoteAddress: '203.0.113.10' }, + })).toBe('unknown-public'); + }); }); diff --git a/packages/web/server/lib/opencode/tunnel-auth.js b/packages/web/server/lib/opencode/tunnel-auth.js index 69cd6aab..5326b8a5 100644 --- a/packages/web/server/lib/opencode/tunnel-auth.js +++ b/packages/web/server/lib/opencode/tunnel-auth.js @@ -172,19 +172,10 @@ const isLocalHost = (host, req) => { return false; } - if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') { - return true; - } - - if (isPrivateOrLoopbackIp(host)) { - return true; - } - - if (host === 'host.docker.internal') { - return isPrivateOrLoopbackIp(getSocketRemoteIp(req)); - } - - return false; + const isLocalHostname = host === 'localhost' + || host === 'host.docker.internal' + || isPrivateOrLoopbackIp(host); + return isLocalHostname && isPrivateOrLoopbackIp(getSocketRemoteIp(req)); }; const getClientIp = (req) => {