From 2cebe81512a56272a453afe08d8c00b6888d2b7b Mon Sep 17 00:00:00 2001 From: Gautam Sharma <148205237+GautamSharma99@users.noreply.github.com> Date: Sat, 11 Jul 2026 08:41:48 +0530 Subject: [PATCH] fix(web): bypass auth proxy for local dev (#1213) Co-authored-by: Dhravya Shah Co-authored-by: Dhravya Shah Co-authored-by: Claude Fable 5 --- CONTRIBUTING.md | 11 +---------- apps/web/middleware.ts | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2e7c29ec..feb1ed41 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -36,16 +36,7 @@ Before you begin, ensure you have the following installed: # You'll need to add your API keys and database URLs ``` -4. **Change proxy for local development** - - Add this in your `proxy.ts`(apps/web) before retrieving the cookie (`getSessionCookie(request)`): - - ```ts - if (url.hostname === "localhost") { - return NextResponse.next(); - } - -5. **Start the Development Server** +4. **Start the Development Server** ```bash bun run dev:local diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts index b0e7879f..ea7b1ec1 100644 --- a/apps/web/middleware.ts +++ b/apps/web/middleware.ts @@ -2,6 +2,8 @@ import { getSessionCookie } from "better-auth/cookies" import { NextResponse } from "next/server" import { getPublicRequestUrl } from "@/lib/url-helpers" +const LOCAL_DEV_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]) + function getAuthSessionCookie(request: Request): string | null { return ( getSessionCookie(request) ?? @@ -16,6 +18,18 @@ export default async function proxy(request: Request) { console.debug("[PROXY] Path:", url.pathname) console.debug("[PROXY] Method:", request.method) + // Development builds only: getPublicRequestUrl trusts x-forwarded-host, so + // a hostname check alone could be spoofed in production to skip the /api + // 401 gate below. NODE_ENV is inlined at build time, making this dead code + // in production bundles. + if ( + process.env.NODE_ENV === "development" && + LOCAL_DEV_HOSTS.has(url.hostname) + ) { + console.debug("[PROXY] Local dev host, allowing access") + return NextResponse.next() + } + const sessionCookie = getAuthSessionCookie(request) console.debug("[PROXY] Session cookie exists:", !!sessionCookie)