Decouple CSRF origin from proxy trust via PUBLIC_ORIGIN; drop 0.0.0.0/0 from templates

[DavidBabinec]

Security finding

A review flagged the Render/Railway deploy templates shipping TRUSTED_PROXY_CIDRS=0.0.0.0/0,::/0 — blanket trust of every forwarding header from any peer.

The auth path was never spoof-bypassable. clientIp() walks X-Forwarded-For right-to-left and returns the nearest untrusted IP, so 0.0.0.0/0 degrades to the real socket peer rather than trusting a forged leftmost value. The real reason for the broad value was that blanket proxy trust was the only way the CSRF origin check worked behind a TLS-terminating edge: the container sees plain HTTP, so expectedOrigin() built http://host while the browser sent https://host → Forbidden: invalid origin.

Single-mechanism fix

The CSRF origin check now derives the expected public origin only from a configured / auto-detected public origin. The X-Forwarded-Host / X-Forwarded-Proto trust is removed from the CSRF path entirely. TRUSTED_PROXY_CIDRS survives but is now used only for client-IP attribution in clientIp() (audit logs / rate-limit keys).

One-click deploys stay one-click via platform auto-detection — no value the user must type:

• Render: auto-injects RENDER_EXTERNAL_URL → used directly.
• Railway: auto-injects RAILWAY_PUBLIC_DOMAIN → https://${RAILWAY_PUBLIC_DOMAIN}. Templates set PUBLIC_ORIGIN=https://${{RAILWAY_PUBLIC_DOMAIN}} explicitly for clarity / custom-domain edits.

Code

• config (server/config.ts): add publicOrigins + resolvePublicOrigins(env) (precedence: PUBLIC_ORIGIN CSV → RENDER_EXTERNAL_URL / https://RAILWAY_PUBLIC_DOMAIN → []) and a shared, exported normalizeOrigin() (URL-based, no regex, no as).
• security (server/auth/security.ts): expectedOrigin returns the configured canonical origin (Host/req.url fallback when none configured); originAllowed matches the full configured allowlist + dev allowlist, normalizing both sides; added configurePublicOrigins / publicOriginIsHttps; deleted the now-unused trustedForwardedHeader. clientIp / stampSocketIp / trusted-proxy logic unchanged.
• forms (server/forms/handler.ts): replaced the inline CSRF duplicate (which ignored the multi-origin allowlist) with the shared originAllowed(req) — forms now semantically identical to the admin/AI check.
• session (server/handlers/cms/session.ts): requestIsHttps derives Secure from the public-origin scheme via publicOriginIsHttps(); dropped the x-forwarded-proto read.
• boot (server/index.ts): configurePublicOrigins(config.publicOrigins).

Templates / docs

• Removed TRUSTED_PROXY_CIDRS=0.0.0.0/0,::/0 from both Render blueprints and the Railway / docker-image snippets; Railway/Caddy now set PUBLIC_ORIGIN, Render relies on auto-detect.
• compose.tls.yml sets PUBLIC_ORIGIN=https://${DOMAIN} and reframes TRUSTED_PROXY_CIDRS as attribution-only.
• Updated README, render.md, railway.md, docker-image.md, vps.md, tls-caddy.md, server.md, auth-and-access.md, .env.production.example. Every 0.0.0.0/0 mention left is now an explicit "never use this" warning; no stale "set TRUSTED_PROXY_CIDRS for CSRF" guidance remains.

Tests

• resolvePublicOrigins + normalizeOrigin (new serverConfig.test.ts).
• expectedOrigin ignores spoofed forwarded headers even from a trusted proxy; falls back to Host/req.url.
• originAllowed matches multiple configured origins; rejects mismatches; dev allowlist intact.
• Forms CSRF regression: an Origin matching a non-canonical configured origin passes (guards the allowlist bug).
• Cookie Secure: https public origin ⇒ Secure even when req.url is http and no x-forwarded-proto.
• clientIp regression guard (unchanged behavior).

Verification

• bun run build — pass (tsc + vite)
• bun run lint — clean
• bun test — 5019 pass / 0 fail (533 files)

Judgment calls

• Custom domains: PUBLIC_ORIGIN accepts a comma-separated list so platform + custom domain coexist; docs tell custom-domain users to append their origin.
• vps.md / compose.tls.yml: Caddy path now sets PUBLIC_ORIGIN=https://${DOMAIN} as THE CSRF mechanism; TRUSTED_PROXY_CIDRS reframed as the optional Caddy-CIDR attribution knob.
• Other consumers of the removed forwarded-header path: none — trustedForwardedHeader had no callers besides expectedOrigin; the AI and CMS handlers already shared originAllowed, and forms was the only inline duplicate.

🤖 Generated with Claude Code