@hosty-sdk/app 0.16.1 → 0.16.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/install-server.js +16 -1
- package/package.json +4 -4
package/dist/install-server.js
CHANGED
|
@@ -24,7 +24,22 @@ export function createInstallationRouteHandler(config, options = {}) {
|
|
|
24
24
|
return Response.json({ code: "hosty_misconfigured", message: "Installation public origin is invalid." }, { status: 503 });
|
|
25
25
|
}
|
|
26
26
|
}
|
|
27
|
-
|
|
27
|
+
const origin = request.headers.get("origin");
|
|
28
|
+
let sameOrigin = origin === expectedOrigin;
|
|
29
|
+
// Next may reconstruct request.url with localhost while the browser uses a loopback IP.
|
|
30
|
+
// Without an explicit public origin, accept the actual Host only with the browser's
|
|
31
|
+
// unforgeable-by-page-script same-origin Fetch Metadata. Host/forwarded headers alone
|
|
32
|
+
// must never authorize a cookie-authenticated mutation.
|
|
33
|
+
if (!options.publicOrigin?.trim() && !sameOrigin && request.headers.get("sec-fetch-site") === "same-origin") {
|
|
34
|
+
try {
|
|
35
|
+
const browserOrigin = new URL(origin ?? "");
|
|
36
|
+
sameOrigin = ["http:", "https:"].includes(browserOrigin.protocol)
|
|
37
|
+
&& browserOrigin.origin === origin
|
|
38
|
+
&& browserOrigin.host === request.headers.get("host");
|
|
39
|
+
}
|
|
40
|
+
catch { /* Missing, opaque or malformed origins remain denied. */ }
|
|
41
|
+
}
|
|
42
|
+
if (request.method !== "GET" && (!sameOrigin ||
|
|
28
43
|
!request.headers.get("content-type")?.startsWith("application/json")))
|
|
29
44
|
return Response.json({ code: "origin_denied", message: "A same-origin JSON request is required." }, { status: 403 });
|
|
30
45
|
const token = readAppIdentityToken(request.headers, config);
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hosty-sdk/app",
|
|
3
|
-
"version": "0.16.
|
|
3
|
+
"version": "0.16.2",
|
|
4
4
|
"description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"type": "module",
|
|
@@ -62,7 +62,7 @@
|
|
|
62
62
|
"server-only": "^0.0.1"
|
|
63
63
|
},
|
|
64
64
|
"peerDependencies": {
|
|
65
|
-
"next": "^16.3.
|
|
65
|
+
"next": "^16.3.6",
|
|
66
66
|
"react": "^19.2.8"
|
|
67
67
|
},
|
|
68
68
|
"peerDependenciesMeta": {
|
|
@@ -74,10 +74,10 @@
|
|
|
74
74
|
}
|
|
75
75
|
},
|
|
76
76
|
"devDependencies": {
|
|
77
|
-
"@types/node": "^24.
|
|
77
|
+
"@types/node": "^24.19.0",
|
|
78
78
|
"@types/react": "^19.3.0",
|
|
79
79
|
"typescript": "^6",
|
|
80
|
-
"vitest": "^5.0.
|
|
80
|
+
"vitest": "^5.0.2"
|
|
81
81
|
},
|
|
82
82
|
"repository": {
|
|
83
83
|
"type": "git",
|