From d40b76e8f29308b73dec17e6190e823c42576343 Mon Sep 17 00:00:00 2001 From: Falkan Date: Fri, 20 Mar 2026 00:12:40 -0400 Subject: [PATCH] fix: use $env/dynamic/private in hooks.server.ts for CSRF allowlist - ALLOWED_ORIGINS and NODE_ENV now read via $env/dynamic/private so Vite dev server picks them up correctly from .env - .env.example: document ALLOWED_ORIGINS with dev IP example - .env: add http://192.168.0.94:5173 to ALLOWED_ORIGINS for local dev --- .env.example | 5 ++++- src/hooks.server.ts | 11 ++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.env.example b/.env.example index daf3a5f..17d557d 100644 --- a/.env.example +++ b/.env.example @@ -1,7 +1,10 @@ # Copy this to .env and fill in values for local development. # In production, set these as environment variables / Kubernetes secrets. -# bcrypt hash of the admin password. Generate with: +# Comma-separated list of additional allowed CORS origins. +# Add your dev machine's IP here if accessing via IP address. +# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173 +ALLOWED_ORIGINS= # python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())" PASSWORD_HASH= diff --git a/src/hooks.server.ts b/src/hooks.server.ts index 56b109f..6599227 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -1,4 +1,5 @@ import { type Handle } from '@sveltejs/kit'; +import { env } from '$env/dynamic/private'; /** * CSRF origin allowlist. @@ -6,8 +7,9 @@ import { type Handle } from '@sveltejs/kit'; * Production: set ALLOWED_ORIGINS to a comma-separated list of trusted origins. * e.g. ALLOWED_ORIGINS=https://humorunits.com,https://dickloads.com * - * Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV=development), localhost and + * Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV != production), localhost and * local IPs are permitted automatically so `npm run dev` works without config. + * Add your dev machine's IP to ALLOWED_ORIGINS in .env if accessing via IP. */ function buildAllowedOrigins(): Set { const origins = new Set(); @@ -18,8 +20,8 @@ function buildAllowedOrigins(): Set { origins.add('https://dickloads.com'); origins.add('https://www.dickloads.com'); - // Additional origins from env (e.g. staging, preview URLs) - const extra = process.env.ALLOWED_ORIGINS; + // Additional origins from env (e.g. dev IP, staging, preview URLs) + const extra = env.ALLOWED_ORIGINS; if (extra) { for (const o of extra.split(',')) { const trimmed = o.trim(); @@ -28,9 +30,8 @@ function buildAllowedOrigins(): Set { } // In development (or when no explicit origins override is set), allow localhost - if (process.env.NODE_ENV !== 'production' || !extra) { + if (env.NODE_ENV !== 'production' || !extra) { origins.add('http://localhost'); - // Allow any localhost port for (const port of [3000, 4173, 5173]) { origins.add(`http://localhost:${port}`); }