Allow multiple trusted origins for form submissions

[mauricewipf]

Summary

Adds an optional TRUSTED_ORIGINS env var so self-hosted deployments can accept form POSTs from more than one hostname (e.g. Umbrel .local plus Tailscale MagicDNS or LAN IP), while keeping CSRF protection enabled.

Existing installs with only ORIGIN set are unaffected — TRUSTED_ORIGINS is purely additive.

Fixes #133

Problem

When Invio is accessed over a hostname different from the configured ORIGIN, login and other form actions fail with:

{\"message\":\"Cross-site POST form submissions are forbidden\"}

Common example (Umbrel):

• Local: http://umbrel.local:8003 — works
• Tailscale: http://umbrel-home.<tailnet>.ts.net:8003 — rejected

SvelteKit's built-in CSRF only compares Origin against one server-side origin, and csrf.trustedOrigins in svelte.config.js is build-time — not configurable per install.

Solution

Move the CSRF origin gate into hooks.server.ts so the allowlist can be set at runtime:

• ORIGIN — canonical origin (unchanged; still respected)
• TRUSTED_ORIGINS — optional comma-separated extra origins
  • exact origins: http://tailscale.local:8000
  • glob: http://*.ts.net:8003
  • * to allow all (trusted networks only)
• Skipped in dev (matches SvelteKit's built-in behavior)
• When neither env var is set, allow same-host form posts only (Origin host matches request Host, scheme ignored). This fixes HTTP deployments where adapter-node would otherwise default to https:// origin.

Backward compatibility

Existing setup	Change needed?
ORIGIN=http://localhost:8000 only (Docker)	No
ORIGIN=http://\${DEVICE_DOMAIN_NAME}:8003 only (Umbrel)	No
vite dev without env vars	No (skipped in dev)
Tailscale / LAN IP access	Opt in via TRUSTED_ORIGINS

Testing

• Bun unit tests in frontend/src/lib/csrf.test.ts covering exact, glob, wildcard, missing origin, and Host-header fallback (bun run test)
• Type check: bun run check — 0 errors (4 pre-existing warnings unrelated to this PR)
• Verified locally with a production-mode sandbox (adapter-node + Deno backend) POSTing /login?/login from multiple hostnames via curl --resolve, all scenarios pass (canonical, extra trusted origin, glob, wildcard, empty-env same-host, blocked cross-host)

For Umbrel packaging (separate PR)

After this ships, the umbrel-apps invio/docker-compose.yml frontend service can add:

TRUSTED_ORIGINS: \"http://\${DEVICE_DOMAIN_NAME}:8003,http://\${DEVICE_HOSTNAME}:8003,http://*.ts.net:8003\"

Files

• frontend/svelte.config.js — disable built-in origin gate (delegated to hook)
• frontend/src/hooks.server.ts — production-only runtime CSRF check
• frontend/src/lib/csrf.ts — matcher (exact/glob/wildcard + host-header fallback)
• frontend/src/lib/csrf.test.ts — 13 unit tests
• frontend/package.json — add test script and @types/bun devDependency
• .env.example — document TRUSTED_ORIGINS

Made with Cursor

[kittendevv]

Thanks for this awesome work