fix(auth): reject spoofed local host headers

2026-07-12 00:46:41 +03:00
parent 4f65e01a63
commit a8953ad6f9
2 changed files with 14 additions and 13 deletions
@@ -172,19 +172,10 @@ const isLocalHost = (host, req) => {
    return false;
  }

-  if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') {
-    return true;
-  }
-
-  if (isPrivateOrLoopbackIp(host)) {
-    return true;
-  }
-
-  if (host === 'host.docker.internal') {
-    return isPrivateOrLoopbackIp(getSocketRemoteIp(req));
-  }
-
-  return false;
+  const isLocalHostname = host === 'localhost'
+    || host === 'host.docker.internal'
+    || isPrivateOrLoopbackIp(host);
+  return isLocalHostname && isPrivateOrLoopbackIp(getSocketRemoteIp(req));
 };

 const getClientIp = (req) => {