fix(server): auto-bind 0.0.0.0 when allowedHosts includes a reverse-proxy domain

2026-11-02 14:31:03 -06:00
parent 557a58af27
commit aea97cd929
1 changed files with 22 additions and 7 deletions
@@ -160,20 +160,35 @@ export async function buildApp() {
    return false;
  }

+  function hasExternalAllowedHost(allowedHostsRaw: string): boolean {
+    const tokens = allowedHostsRaw
+      .split(/[,\s]+/)
+      .map((t) => extractHostname(t))
+      .filter(Boolean);
+    return tokens.some(
+      (t) => t !== "localhost" && t !== "127.0.0.1" && t !== "::1" && t !== "[::1]",
+    );
+  }
+
  function loadPersistedServerSysConfig(): PersistedServerSysConfig {
    try {
      if (existsSync(sysConfigPath)) {
        const raw = JSON.parse(readFileSync(sysConfigPath, "utf8")) as Partial<PersistedServerSysConfig>;
+        const allowedHosts =
+          typeof raw.allowedHosts === "string" && raw.allowedHosts.trim()
+            ? raw.allowedHosts.trim()
+            : "localhost, 127.0.0.1";
+        const rawHost =
+          typeof raw.host === "string" && raw.host.trim()
+            ? raw.host.trim()
+            : "127.0.0.1";
        return {
          enabled: typeof raw.enabled === "boolean" ? raw.enabled : true,
          host:
-            typeof raw.host === "string" && raw.host.trim()
-              ? raw.host.trim()
-              : "127.0.0.1",
-          allowedHosts:
-            typeof raw.allowedHosts === "string" && raw.allowedHosts.trim()
-              ? raw.allowedHosts.trim()
-              : "localhost, 127.0.0.1",
+            rawHost === "127.0.0.1" && hasExternalAllowedHost(allowedHosts)
+              ? "0.0.0.0"
+              : rawHost,
+          allowedHosts,
          port:
            typeof raw.port === "number" && raw.port >= 1024 && raw.port <= 65535
              ? raw.port