337b722cf2
- hooks.server.ts: replace empty stub with multi-origin CSRF guard
- Always allows humorunits.com and dickloads.com (+ www variants)
- ALLOWED_ORIGINS env var for additional origins (staging, preview)
- Dev: localhost:3000/4173/5173 auto-allowed when NODE_ENV != production
or ALLOWED_ORIGINS is unset — no config needed for local dev
- svelte.config.js: disable built-in single-origin CSRF check (we own it now)
trustProxy: true so X-Forwarded-Proto/IP are correct behind nginx-ingress
- login route: derive secure-cookie flag from X-Forwarded-Proto header so
session cookies are marked Secure even when Node sees plain HTTP from ingress
- deployment.yaml: add NODE_ENV=production and explicit ALLOWED_ORIGINS
24 lines
658 B
JavaScript
24 lines
658 B
JavaScript
import adapter from '@sveltejs/adapter-node';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
kit: {
|
|
adapter: adapter({
|
|
// Trust X-Forwarded-Proto / X-Forwarded-For from the nginx-ingress.
|
|
// Required so that `url.protocol` and client IP are correct behind the proxy.
|
|
trustProxy: true,
|
|
}),
|
|
// Disable SvelteKit's built-in single-origin CSRF check — we handle it
|
|
// ourselves in hooks.server.ts with a multi-origin allowlist.
|
|
csrf: {
|
|
checkOrigin: false,
|
|
},
|
|
},
|
|
vitePlugin: {
|
|
dynamicCompileOptions: ({ filename }) =>
|
|
filename.includes('node_modules') ? undefined : { runes: true }
|
|
}
|
|
};
|
|
|
|
export default config;
|