ekklesiaandClaude Sonnet 5
cafd513019
Replace Better Auth's default trust of a caller-controlled X-Forwarded-For with a platform-owned client-address resolution boundary: direct mode (the safe default) trusts only the real socket peer, and an explicit trusted-proxy mode requires a header name, a concrete trusted-proxy list, and only honors a forwarded chain from an actual trusted peer. This closes a rate-limit bypass where rotating a spoofed header let a caller choose a fresh bucket on every request. Public sign-up is also disabled by default and requires an explicit typed opt-in, using Better Auth's own disableSignUp gate so no email-existence leak or second signup path is introduced. Co-Authored-By: Claude Sonnet 5 <[email protected]>
5 lines
127 B
TypeScript
5 lines
127 B
TypeScript
export * from "./client-address.js";
|
|
export * from "./config.js";
|
|
export * from "./database.js";
|
|
export * from "./runtime.js";
|