falkan/dickloads
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use $env/dynamic/private in hooks.server.ts for CSRF allowlist

Browse Source 
- ALLOWED_ORIGINS and NODE_ENV now read via $env/dynamic/private so Vite dev
  server picks them up correctly from .env
- .env.example: document ALLOWED_ORIGINS with dev IP example
- .env: add http://192.168.0.94:5173 to ALLOWED_ORIGINS for local dev
This commit is contained in:
Falkan
2026-03-20 00:12:40 -04:00
parent 6198c58055
commit d40b76e8f2
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.env.example
View File

@@ -1,7 +1,10 @@
# Copy this to .env and fill in values for local development. # Copy this to .env and fill in values for local development.
# In production, set these as environment variables / Kubernetes secrets. # In production, set these as environment variables / Kubernetes secrets.
# bcrypt hash of the admin password. Generate with: # Comma-separated list of additional allowed CORS origins.
# Add your dev machine's IP here if accessing via IP address.
# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
ALLOWED_ORIGINS=
# python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())" # python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
PASSWORD_HASH= PASSWORD_HASH=

11
src/hooks.server.ts
View File

@@ -1,4 +1,5 @@
import { type Handle } from '@sveltejs/kit'; import { type Handle } from '@sveltejs/kit';
import { env } from '$env/dynamic/private';
/** /**
* CSRF origin allowlist. * CSRF origin allowlist.
@@ -6,8 +7,9 @@ import { type Handle } from '@sveltejs/kit';
* Production: set ALLOWED_ORIGINS to a comma-separated list of trusted origins. * Production: set ALLOWED_ORIGINS to a comma-separated list of trusted origins.
* e.g. ALLOWED_ORIGINS=https://humorunits.com,https://dickloads.com * e.g. ALLOWED_ORIGINS=https://humorunits.com,https://dickloads.com
* *
* Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV=development), localhost and * Dev: if ALLOWED_ORIGINS is unset (or NODE_ENV != production), localhost and
* local IPs are permitted automatically so `npm run dev` works without config. * local IPs are permitted automatically so `npm run dev` works without config.
* Add your dev machine's IP to ALLOWED_ORIGINS in .env if accessing via IP.
*/ */
function buildAllowedOrigins(): Set<string> { function buildAllowedOrigins(): Set<string> {
const origins = new Set<string>(); const origins = new Set<string>();
@@ -18,8 +20,8 @@ function buildAllowedOrigins(): Set<string> {
origins.add('https://dickloads.com'); origins.add('https://dickloads.com');
origins.add('https://www.dickloads.com'); origins.add('https://www.dickloads.com');
// Additional origins from env (e.g. staging, preview URLs) // Additional origins from env (e.g. dev IP, staging, preview URLs)
const extra = process.env.ALLOWED_ORIGINS; const extra = env.ALLOWED_ORIGINS;
if (extra) { if (extra) {
for (const o of extra.split(',')) { for (const o of extra.split(',')) {
const trimmed = o.trim(); const trimmed = o.trim();
@@ -28,9 +30,8 @@ function buildAllowedOrigins(): Set<string> {
} }
// In development (or when no explicit origins override is set), allow localhost // In development (or when no explicit origins override is set), allow localhost
if (process.env.NODE_ENV !== 'production' || !extra) { if (env.NODE_ENV !== 'production' || !extra) {
origins.add('http://localhost'); origins.add('http://localhost');
// Allow any localhost port
for (const port of [3000, 4173, 5173]) { for (const port of [3000, 4173, 5173]) {
origins.add(`http://localhost:${port}`); origins.add(`http://localhost:${port}`);
} }