verifyRecaptcha: check x-forwarded-host before host header

Tor users access via .onion through a forwarding layer that puts the
real hostname in x-forwarded-host while the literal host header is the
internal target. Without checking the forwarded header first, captcha
prompted for .onion visitors who should have been exempt.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

1 files changed, 1 insertions, 1 deletions

diff --git a/routes/users.ts b/routes/users.ts
index 00083e38..05572b12 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -39,7 +39,7 @@ const verifyRecaptcha = async (response, c?, body?) => {
   const { recaptcha: secret } = config;
   if (!secret) return true;
 
-  const reqHost = c?.req?.header("host") || "";
+  const reqHost = c?.req?.header("x-forwarded-host") || c?.req?.header("host") || "";
   if (reqHost.endsWith(".onion")) return true;
 
   const uaRaw = c?.req?.header("user-agent");