@selvajs/cli 4.20.0-beta.20 → 4.20.0-beta.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/src/prompts.js CHANGED
@@ -143,6 +143,11 @@ export function collectConfigFromEnv(env = process.env) {
143
143
  }
144
144
  values.ORIGIN = origin;
145
145
 
146
+ // Behind a proxy the app must only be reachable through it: ADDRESS_HEADER
147
+ // trusts client-supplied X-Forwarded-For, so a direct caller on a public
148
+ // bind picks its own rate-limit bucket.
149
+ if (origin && !values.HOST) values.HOST = env.HOST || '127.0.0.1';
150
+
146
151
  // An explicitly-set flag is preserved verbatim even when tenancy makes it
147
152
  // inert: rewriting it to '' would hide the operator's misconfiguration
148
153
  // rather than fix it, and the server already reads every key as opt-in.
@@ -483,6 +488,10 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
483
488
  });
484
489
  cancelOn(flags);
485
490
 
491
+ // Same reason as in collectConfigFromEnv: behind a proxy, bind loopback
492
+ // unless an existing .env already chose a host.
493
+ if (behindProxy && !providerValues.HOST) providerValues.HOST = defaults.HOST || '127.0.0.1';
494
+
486
495
  const values = {
487
496
  SELVA_TENANCY: tenancy,
488
497
  SELVA_AUTH_PROVIDER: auth,