From 55aa26bad5e85baacab67725114ceac97b1153b3 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 6 Feb 2026 17:24:16 +0000 Subject: check forwarded host header --- routes/users.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routes/users.ts b/routes/users.ts index 64659a01..19c014c9 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -30,7 +30,7 @@ const verifyRecaptcha = async (response, req?) => { if (!secret) return true; // Skip captcha for Tor users accessing via .onion - const host = req?.headers?.["host"] || ""; + const host = req?.headers?.["x-forwarded-host"] || req?.headers?.["host"] || ""; if (host.endsWith(".onion")) return true; // Skip captcha for allowlisted User-Agents (prefix match) -- cgit v1.2.3