From 7f4bf4d886bd43f3b15f18e3c4f7c040892e9f73 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 17 May 2026 23:48:59 -0700 Subject: verifyRecaptcha: check x-forwarded-host before host header Tor users access via .onion through a forwarding layer that puts the real hostname in x-forwarded-host while the literal host header is the internal target. Without checking the forwarded header first, captcha prompted for .onion visitors who should have been exempt. Co-Authored-By: Claude Opus 4.7 (1M context) --- routes/users.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'routes') diff --git a/routes/users.ts b/routes/users.ts index 00083e38..05572b12 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -39,7 +39,7 @@ const verifyRecaptcha = async (response, c?, body?) => { const { recaptcha: secret } = config; if (!secret) return true; - const reqHost = c?.req?.header("host") || ""; + const reqHost = c?.req?.header("x-forwarded-host") || c?.req?.header("host") || ""; if (reqHost.endsWith(".onion")) return true; const uaRaw = c?.req?.header("user-agent"); -- cgit v1.2.3