diff options
| author | Adam Soltys <[email protected]> | 2026-05-17 23:48:59 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-05-17 23:48:59 -0700 |
| commit | 7f4bf4d886bd43f3b15f18e3c4f7c040892e9f73 (patch) | |
| tree | 3641911141036f7309ca9615140726adddad727b /scripts/createExceptions.js | |
| parent | dfd31ad83d24e780523f4e76d04a76aba1fa8be1 (diff) | |
| download | coinos-server-7f4bf4d886bd43f3b15f18e3c4f7c040892e9f73.tar.gz coinos-server-7f4bf4d886bd43f3b15f18e3c4f7c040892e9f73.zip | |
verifyRecaptcha: check x-forwarded-host before host header
Tor users access via .onion through a forwarding layer that puts the
real hostname in x-forwarded-host while the literal host header is the
internal target. Without checking the forwarded header first, captcha
prompted for .onion visitors who should have been exempt.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Diffstat (limited to 'scripts/createExceptions.js')
0 files changed, 0 insertions, 0 deletions