forked from Mike/freno-dev
1d9287a199
The security review of 39d874a (FRE-369) found the address fix recorded
the wrong thing twice. Both are fixed here; the branch is the same one
under review, this commit does not rewrite it.
Q1 — the first x-forwarded-for hop is attacker-chosen text. In
client → Cloudflare → same-host proxy → app, both proxies *append*, so
the header arrives as `<client spoof…>, <true client>, <CF edge>` and
`split(",")[0]` took the sender's own invention — the loopback-peer gate
was sound, the hop selection defeated it. Preference is now
`cf-connecting-ip` (Cloudflare overwrites it, so a client value never
survives the edge), then x-forwarded-for counted from the right with one
trusted hop discounted, then the direct peer. Every candidate must parse
as an address. h3's `getRequestIP(…, { xForwardedFor: true })` has the
same leftmost flaw and is documented as not a fix.
Q4 — the table held full client addresses indefinitely. Every analytics
entry now passes through `truncateIpAddress` in `enrichAnalyticsEntry`
(IPv4 /24, IPv6 /56, unparseable dropped), so no writer can persist a
full address by accident. Retention got the schedule it never had:
`/api/analytics/retention` on a daily Vercel cron, Bearer-authenticated
and fail-closed, with the window parameterised (the old
`cleanupOldAnalytics` spliced the number into the SQL). Default 365 days
rather than the review's 90 so enabling the cron is not itself a
destructive event — the tighter window is an operational decision, named
on the task.
Also from the review: the module doc now forbids feeding this helper into
any security decision; `isLoopbackAddress` parses instead of
string-matching (`::ffff:127.9.9.9`, `0:0:0:0:0:0:0:1`); and `host` is
normalised (lowercased, port stripped) so `nook.freno.me:443` cannot
silently miss the `host = ?` scope. The weekly loopback caveat matches
the truncated shapes writers produce now, and says plainly that "unique
visitors" counts prefixes.
64 lines
1.9 KiB
JSON
64 lines
1.9 KiB
JSON
{
|
|
"rewrites": [
|
|
{
|
|
"source": "/api/(.*)",
|
|
"has": [{ "type": "host", "value": "gaze.freno.me" }],
|
|
"destination": "/api/$1"
|
|
},
|
|
{
|
|
"source": "/api/(.*)",
|
|
"has": [{ "type": "host", "value": "inputhalo.freno.me" }],
|
|
"destination": "/api/$1"
|
|
},
|
|
{
|
|
"source": "/api/(.*)",
|
|
"has": [{ "type": "host", "value": "nessa.freno.me" }],
|
|
"destination": "/api/$1"
|
|
},
|
|
{
|
|
"source": "/api/(.*)",
|
|
"has": [{ "type": "host", "value": "lineage.freno.me" }],
|
|
"destination": "/api/$1"
|
|
},
|
|
{ "source": "/(.*)", "has": [{ "type": "host", "value": "nessa.freno.me" }], "destination": "/nessa/$1" },
|
|
{ "source": "/(.*)", "has": [{ "type": "host", "value": "lineage.freno.me" }], "destination": "/lineage/$1" },
|
|
{ "source": "/(.*)", "has": [{ "type": "host", "value": "gaze.freno.me" }], "destination": "/gaze/$1" },
|
|
{ "source": "/(.*)", "has": [{ "type": "host", "value": "inputhalo.freno.me" }], "destination": "/inputhalo/$1" },
|
|
{ "source": "/api/(.*)", "has": [{ "type": "host", "value": "nook.freno.me" }], "destination": "/api/$1" },
|
|
{ "source": "/(.*)", "has": [{ "type": "host", "value": "nook.freno.me" }], "destination": "/nook/$1" }
|
|
],
|
|
"headers": [
|
|
{
|
|
"source": "/",
|
|
"headers": [
|
|
{
|
|
"key": "Cache-Control",
|
|
"value": "public, max-age=0, must-revalidate"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "/(.*)",
|
|
"headers": [
|
|
{
|
|
"key": "Cache-Control",
|
|
"value": "public, max-age=0, must-revalidate"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "/_build/(.*)",
|
|
"headers": [
|
|
{
|
|
"key": "Cache-Control",
|
|
"value": "public, max-age=31536000, immutable"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"crons": [
|
|
{ "path": "/api/analytics-retention", "schedule": "0 12 * * *" },
|
|
{ "path": "/api/the-nook/lifecycle", "schedule": "0 13 * * *" }
|
|
]
|
|
}
|