Repository navigation
fix(auth): honor X-Forwarded-Proto when validating NIP-98 URLs - #2
Merged
Merged
Conversation
Behind a TLS-terminating reverse proxy (bundled Caddy, Nginx Proxy Manager, ...) the app receives plain HTTP, and @hono/node-server derives the request scheme only from the socket. The browser signs the public https:// URL, so every authenticated dashboard call failed with "NIP-98 URL mismatch": the keypair stayed on "Generating...", no QR code rendered, and new connections never appeared. The middleware now takes the scheme from X-Forwarded-Proto (host still comes from the Host header, so a token signed for another site can't be replayed by spoofing X-Forwarded-Host). An optional PUBLIC_URL env var pins the origin for proxies that don't forward these headers. Fixes #1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WYVXxXnVonPB4UYazaLLRK
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Behind a reverse proxy that terminates TLS (the bundled Caddy, Nginx Proxy Manager, Traefik, …) the app receives plain HTTP.
@hono/node-serverderives the request scheme only fromsocket.encrypted, soc.req.urlishttp://…while the dashboard signs the publichttps://…URL in the NIP-98utag. Every authenticated API call therefore fails with401 NIP-98 URL mismatch, which shows up as: keypair stuck on "Generating...", no QR code, new connections never appearing.Changes:
middleware/nip98.ts: newgetExternalRequestUrl()takes the scheme fromX-Forwarded-Proto(first value of a chain,http/httpsonly). The host still comes from theHostheader;X-Forwarded-Hostis deliberately not trusted, so a token signed for another site can't be replayed here by spoofing a header.PUBLIC_URLenv var pins the public origin for proxies that don't forward these headers.nip98_auth.test.ts(forwarded proto, proto chain, no headers → still 401,X-Forwarded-Hostreplay → 401,PUBLIC_URL)..env.example/.env.dist.Related Issues
Fixes #1
Domain Agent Checklist
@agent-arch: API router & SQLite storage compatibility verified.@agent-nostr: NIP compliance & cryptographic signatures verified (exact-matchutag check unchanged; only the server-side expected URL is corrected).@agent-ui: TailAdmin UI design & NIP-07 state verified. (No UI changes.)@agent-devops: typecheck, lint (0 errors) and tests (43/43) pass locally.🤖 Generated with Claude Code
https://claude.ai/code/session_01WYVXxXnVonPB4UYazaLLRK
Generated by Claude Code