cauthy-auth 0.38.2 → 0.39.0

package/dist/index.mjs

@@ -1506,13 +1506,13 @@ function createCauthy(given = {}) {
       return null;
     }
   }
-  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").pop()?.trim() || void 0);
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").map((a) => a.trim()).reverse().find((a) => a !== "" && !ownNetwork(a)));
   let noProofUntil = 0;
   async function passedOn(request) {
     if (Date.now() < noProofUntil) return {};
     const ip = clientIp(request);
     try {
-      const proof = { "x-cauthy-system-token": await ownSystem.token() };
+      const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
       return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
     } catch {
       noProofUntil = Date.now() + 5 * 6e4;
@@ -2417,6 +2417,10 @@ function legalOf(raw) {
     consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
   };
 }
+function ownNetwork(address) {
+  const a = address.toLowerCase();
+  return /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(a) || /^172\.(1[6-9]|2\d|3[01])\./.test(a) || a === "::1" || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith("::ffff:127.") || a === "localhost";
+}
 
 // src/connect.ts
 function sessionSecret() {