mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
0a09fa5a11
The middleware runtime exposes no socket, so a prior fix derived LOCAL_ONLY locality from the Host header — letting a remote caller send Host: 127.0.0.1 and reach spawn-capable routes (RCE class). The custom Node servers now stamp the real socket.remoteAddress into a token-signed internal header; the policy trusts only a stamp whose token matches this process's secret, and fails closed otherwise. Preserves the owner-authorized loopback + private-LAN access without trusting any client-controlled header.