fix: harden user content and connection handling

Author: adrgs

.env.example

@@ -67,9 +67,12 @@ CERT_CHECK_HOURS=12
 # IP_CERT_RENEWAL_HOURS=96
 
 # === Security ===
-# Allow all response headers including dangerous ones like Service-Worker-Allowed
-# Default: false (blocked on main domain path-based routing /r/)
-ALLOW_ALL_HEADERS=false
+# Serve user-controlled content at /r/<subdomain> on the dashboard origin.
+# This is useful for domainless/IP deployments, but weakens origin isolation.
+DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT=false
+# Allow origin-scoped headers such as Service-Worker-Allowed and Alt-Svc on /r/ routes.
+# Has no effect unless same-origin user content is enabled above.
+DANGEROUSLY_ALLOW_ALL_HEADERS=false
 
 # === Error Tracking (Sentry) ===
 # SENTRY_DSN_BACKEND=https://xxx@sentry.io/xxx

README.md

@@ -189,7 +189,8 @@ See [.env.example](.env.example) for all available options.
 | `MAX_REQUEST_BODY_MB` | No | `10` | Max HTTP request body size |
 | `SESSION_RATE_LIMIT` | No | `10` | Max sessions per IP per window |
 | `SESSION_RATE_WINDOW_SECS` | No | `60` | Rate limit window in seconds |
-| `ALLOW_ALL_HEADERS` | No | `false` | Allow dangerous headers (e.g., Service-Worker-Allowed) |
+| `DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT` | No | `false` | Enable `/r/<subdomain>` user content on the dashboard origin (for domainless/IP deployments) |
+| `DANGEROUSLY_ALLOW_ALL_HEADERS` | No | `false` | Allow origin-scoped headers such as `Service-Worker-Allowed` and `Alt-Svc` on `/r/` routes |
 | `RUST_LOG` | No | `info` | Log level (trace, debug, info, warn, error) |
 
 ## Interface

docker-compose.yml

@@ -44,7 +44,8 @@ services:
       - MAX_SUBDOMAIN_SIZE_MB=${MAX_SUBDOMAIN_SIZE_MB:-10}
       - MAX_REQUEST_BODY_MB=${MAX_REQUEST_BODY_MB:-10}
       # Optional - Security
-      - ALLOW_ALL_HEADERS=${ALLOW_ALL_HEADERS:-false}
+      - DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT=${DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT:-false}
+      - DANGEROUSLY_ALLOW_ALL_HEADERS=${DANGEROUSLY_ALLOW_ALL_HEADERS:-false}
       # Optional - Error tracking
       - SENTRY_DSN_BACKEND=${SENTRY_DSN_BACKEND:-}
       - SENTRY_DSN_FRONTEND=${SENTRY_DSN_FRONTEND:-}

frontend/bun.lock

@@ -11,41 +11,44 @@
     "test": "echo 'No tests configured yet'"
   },
   "dependencies": {
-    "@heroui/react": "^2.8.7",
+    "@heroui/react": "^2.8.10",
     "@monaco-editor/react": "^4.7.0",
-    "@sentry/react": "^8.0.0",
-    "@tanstack/react-query": "^5.90.16",
-    "axios": "^1.13.2",
+    "@sentry/react": "^8.55.2",
+    "@tanstack/react-query": "^5.101.4",
+    "axios": "^1.19.0",
     "clsx": "^2.1.1",
-    "esbuild": "^0.27.2",
+    "esbuild": "^0.28.2",
     "flag-icons": "^7.5.0",
-    "framer-motion": "^12.26.1",
+    "framer-motion": "^12.43.0",
     "lucide-react": "^0.562.0",
-    "monaco-editor": "^0.55.1",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
-    "react-router-dom": "^7.12.0",
-    "sonner": "^2.0.7",
-    "tailwind-merge": "^3.4.0",
+    "monaco-editor": "^0.56.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-router-dom": "^7.18.2",
+    "sonner": "^2.0.8",
+    "tailwind-merge": "^3.6.0",
     "vite-plugin-monaco-editor": "^1.1.0",
-    "zustand": "^5.0.10"
+    "zustand": "^5.0.15"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.1",
-    "@tanstack/react-query-devtools": "^5.91.2",
-    "@types/node": "^24.10.1",
-    "@types/react": "^19.2.5",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^5.1.1",
-    "autoprefixer": "^10.4.23",
-    "eslint": "^9.39.1",
-    "eslint-plugin-react-hooks": "^7.0.1",
-    "eslint-plugin-react-refresh": "^0.4.24",
+    "@eslint/js": "^9.39.5",
+    "@tanstack/react-query-devtools": "^5.101.4",
+    "@types/node": "^24.13.3",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^5.2.0",
+    "autoprefixer": "^10.5.4",
+    "eslint": "^9.39.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.4.26",
     "globals": "^16.5.0",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.26",
     "tailwindcss": "3.4.17",
     "typescript": "~5.9.3",
-    "typescript-eslint": "^8.46.4",
-    "vite": "^7.2.4"
+    "typescript-eslint": "^8.67.0",
+    "vite": "^7.3.6"
+  },
+  "overrides": {
+    "dompurify": "3.4.14"
   }
 }

frontend/package.json

@@ -16,6 +16,10 @@ const api = axios.create({
   withCredentials: true, // Send cookies with requests (for admin_token)
 });
 
+const authHeaders = (token: string) => ({
+  Authorization: `Bearer ${token}`,
+});
+
 // Helper to check if we're in offline mode
 function isNetworkError(error: unknown): boolean {
   if (error instanceof AxiosError) {
@@ -51,7 +55,7 @@ export async function createSession(
 export async function getDnsRecords(token: string): Promise<DnsRecord[]> {
   try {
     const { data } = await api.get<{ records: DnsRecord[] }>("/dns", {
-      params: { token },
+      headers: authHeaders(token),
     });
     return data.records || [];
   } catch (error) {
@@ -67,14 +71,14 @@ export async function updateDnsRecords(
   token: string,
   records: DnsRecord[],
 ): Promise<void> {
-  await api.put("/dns", { records }, { params: { token } });
+  await api.put("/dns", { records }, { headers: authHeaders(token) });
 }
 
 // Files API
 export async function getFiles(token: string): Promise<FileTree> {
   try {
     const { data } = await api.get<FileTree>("/files", {
-      params: { token },
+      headers: authHeaders(token),
     });
     return data;
   } catch (error) {
@@ -96,7 +100,7 @@ export async function updateFiles(
   token: string,
   files: FileTree,
 ): Promise<void> {
-  await api.put("/files", files, { params: { token } });
+  await api.put("/files", files, { headers: authHeaders(token) });
 }
 
 // Requests API
@@ -107,7 +111,8 @@ export async function getRequests(
 ): Promise<PaginatedResponse<Request>> {
   try {
     const { data } = await api.get<PaginatedResponse<Request>>("/requests", {
-      params: { token, limit, offset },
+      headers: authHeaders(token),
+      params: { limit, offset },
     });
     return data;
   } catch (error) {
@@ -127,7 +132,7 @@ export async function getRequest(
   requestId: string,
 ): Promise<Request> {
   const { data } = await api.get<Request>(`/requests/${requestId}`, {
-    params: { token },
+    headers: authHeaders(token),
   });
   return data;
 }
@@ -137,13 +142,13 @@ export async function deleteRequest(
   requestId: string,
 ): Promise<void> {
   await api.delete(`/requests/${requestId}`, {
-    params: { token },
+    headers: authHeaders(token),
   });
 }
 
 export async function deleteAllRequests(token: string): Promise<void> {
   await api.delete("/requests", {
-    params: { token },
+    headers: authHeaders(token),
   });
 }
 
@@ -155,7 +160,7 @@ export async function createShareToken(
   const { data } = await api.post<{ share_token: string }>(
     `/requests/${requestId}/share`,
     {},
-    { params: { token } },
+    { headers: authHeaders(token) },
   );
   return data.share_token;
 }

frontend/src/api/client.ts

@@ -27,6 +27,7 @@ declare global {
     __CONFIG__?: {
       DOMAIN?: string;
       SENTRY_DSN_FRONTEND?: string;
+      DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT?: boolean;
     };
   }
 }
@@ -36,6 +37,11 @@ const scrubSensitiveParams = (url: string): string => {
     const u = new URL(url, window.location.origin);
     u.searchParams.delete("token");
     u.searchParams.delete("share");
+    u.searchParams.delete("request");
+    u.pathname = u.pathname.replace(
+      /\/api\/v2\/requests\/shared\/[^/]+$/,
+      "/api/v2/requests/shared/<redacted>",
+    );
     return u.toString();
   } catch {
     return url;

frontend/src/main.tsx

@@ -84,6 +84,8 @@ export function RequestsPage() {
   const subdomain = session?.subdomain || "xxxxxxxx";
   const fullHttpDomain = `${subdomain}.${httpDomain}`;
   const fullDnsDomain = `${subdomain}.${dnsDomain}`;
+  const allowSameOriginUserContent =
+    window.__CONFIG__?.DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT === true;
 
   // Mark as visited when selected (only for non-shared requests)
   useEffect(() => {
@@ -134,9 +136,11 @@ export function RequestsPage() {
 
           <div className="space-y-2 font-mono text-sm">
             <Code className="block p-2">curl http://{fullHttpDomain}</Code>
-            <Code className="block p-2">
-              curl http://{httpDomain}/r/{subdomain}/
-            </Code>
+            {allowSameOriginUserContent && (
+              <Code className="block p-2">
+                curl http://{httpDomain}/r/{subdomain}/
+              </Code>
+            )}
             <Code className="block p-2">
               curl -X POST --data hello http://{fullHttpDomain}
             </Code>