akanjs 3.0.0-alpha.94 → 3.0.0-alpha.96

package/common/index.ts

@@ -82,7 +82,7 @@ export { pathSet } from "./pathSet";
 export { plainFieldsOf } from "./plainFieldsOf";
 export { randomPick } from "./randomPick";
 export { randomPicks } from "./randomPicks";
-export { isJsonContentType, originFromRequest } from "./requestOrigin";
+export { hostFromRequest, isJsonContentType, originFromRequest } from "./requestOrigin";
 export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient";
 export {
   assertUniqueRoutePatterns,

package/common/requestOrigin.ts

@@ -5,8 +5,7 @@
 export const originFromRequest = (headers: Headers, url: URL): string => {
   
   const forwardedProto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
-  const forwardedHost = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-  const host = forwardedHost ?? headers.get("host")?.split(",")[0]?.trim();
+  const host = hostFromRequest(headers, url);
   const proto = forwardedProto ?? url.protocol.slice(0, -1);
   if (host && proto) {
     try {
@@ -17,6 +16,14 @@ export const originFromRequest = (headers: Headers, url: URL): string => {
   return url.origin;
 };
 
+/**
+ * The host a caller addressed, which — unlike the scheme — every proxy that rewrites the request still reports.
+ * `Host` is set by the browser from the URL it was told to open, so it names *this* deployment even for a
+ * request some other page initiated.
+ */
+export const hostFromRequest = (headers: Headers, url: URL): string =>
+  headers.get("x-forwarded-host")?.split(",")[0]?.trim() ?? headers.get("host")?.split(",")[0]?.trim() ?? url.host;
+
 /**
  * Whether a request body may be read as JSON.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-alpha.94",
+  "version": "3.0.0-alpha.96",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/signal/CrossSiteGuard.ts

@@ -1,4 +1,4 @@
-import { isJsonContentType, Logger, originFromRequest } from "akanjs/common";
+import { hostFromRequest, isJsonContentType, Logger } from "akanjs/common";
 import { Exception } from "./exception";
 
 export interface CrossSiteOption {
@@ -62,10 +62,32 @@ export class CrossSiteGuard {
     if (!CrossSiteGuard.#enabled) return;
     const origin = req.headers.get("origin");
     if (origin === null) return;
-    if (origin !== "null" && (origin === originFromRequest(req.headers, url) || CrossSiteGuard.#allowed.has(origin)))
+    if (origin !== "null" && (CrossSiteGuard.#isSameSite(origin, req, url) || CrossSiteGuard.#allowed.has(origin)))
       return;
 
-    CrossSiteGuard.logger.warn(`Refused "${key}" from cross-site origin ${origin}`);
+    CrossSiteGuard.logger.warn(
+      `Refused "${key}" from cross-site origin ${origin} (request host ${hostFromRequest(req.headers, url)})`,
+    );
     throw new Exception.Forbidden("This request was not permitted.");
   }
+
+  /**
+   * Host, not full origin — the same comparison `McpRouter` makes, for the same reason.
+   *
+   * The host is what the browser wrote from the URL it was told to open, so a page on another site POSTing here
+   * still arrives with *our* host and its own `Origin`: comparing hosts refuses every cross-site caller. The
+   * scheme is the one part of the origin a proxy routinely loses — a TLS-terminating edge (a Cloudflare tunnel,
+   * an ingress without `x-forwarded-proto`) dials us over plain HTTP, so an `https://` caller would be measured
+   * against a computed `http://` self and refused on every mutation. What that costs is a page served over
+   * plaintext on our own host, which is an attacker who already holds the name.
+   */
+  static #isSameSite(origin: string, req: Request, url: URL): boolean {
+    try {
+      const { protocol, host } = new URL(origin);
+
+      return host === new URL(`${protocol}//${hostFromRequest(req.headers, url)}`).host;
+    } catch {
+      return false;
+    }
+  }
 }

package/types/common/index.d.ts

@@ -31,7 +31,7 @@ export { pathSet } from "./pathSet.d.ts";
 export { plainFieldsOf } from "./plainFieldsOf.d.ts";
 export { randomPick } from "./randomPick.d.ts";
 export { randomPicks } from "./randomPicks.d.ts";
-export { isJsonContentType, originFromRequest } from "./requestOrigin.d.ts";
+export { hostFromRequest, isJsonContentType, originFromRequest } from "./requestOrigin.d.ts";
 export { RestClient, type RestClientOptions, type RestRequestOptions } from "./restClient.d.ts";
 export { assertUniqueRoutePatterns, compareRouteSpecificity, getPageSourceFileViolation, getRouteExports, isRouteSourceFile, isSpecialRouteLeaf, LAYOUT_ROUTE_EXPORTS, matchRoutePattern, normalizeRoutePattern, PAGE_ROUTE_EXPORTS, type ParsedRouteModuleKey, parseRouteModuleKey, RESERVED_ROUTE_CONFIG_EXPORTS, ROOT_LAYOUT_ROUTE_EXPORTS, type RouteModuleKind, routeSegmentToPatternPart, routeSegmentToTreePath, tryParseRouteModuleKey, type ValidatePageSourceFileOptions, type ValidateSubRoutePageKeyOptions, validatePageSourceFile, validateSubRoutePageKey, } from "./routeConvention.d.ts";
 export { sleep } from "./sleep.d.ts";

package/types/common/requestOrigin.d.ts

@@ -3,6 +3,12 @@
  * they answer the same way for the cache layer, the CSRF gate, and anything else that has to compare origins.
  */
 export declare const originFromRequest: (headers: Headers, url: URL) => string;
+/**
+ * The host a caller addressed, which — unlike the scheme — every proxy that rewrites the request still reports.
+ * `Host` is set by the browser from the URL it was told to open, so it names *this* deployment even for a
+ * request some other page initiated.
+ */
+export declare const hostFromRequest: (headers: Headers, url: URL) => string;
 /**
  * Whether a request body may be read as JSON.
  *