grabowski
0ceee55f9b
Deploy to LXC / deploy (push) Successful in 19s
SvelteKit's built-in CSRF only allows one origin, breaking access via NetBird/Yggdrasil/Tor IPs. Now: - Disabled checkOrigin in svelte.config.js - Custom CSRF in hooks.server.ts checks Origin against ALLOWED_ORIGINS - ALLOWED_ORIGINS env var: comma-separated list of trusted origins - Caddy no longer needs to rewrite Host/Origin headers - Each access method (public domain, NetBird IP, Yggdrasil, Tor onion) just needs its URL added to ALLOWED_ORIGINS Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
557 B
JavaScript
26 lines
557 B
JavaScript
import adapter from '@sveltejs/adapter-node';
|
|
import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
compilerOptions: {
|
|
warningFilter: (warning) => {
|
|
// Intentional: form inputs initialize from props once, then diverge
|
|
if (warning.code === 'state_referenced_locally') return false;
|
|
return true;
|
|
}
|
|
},
|
|
preprocess: vitePreprocess(),
|
|
kit: {
|
|
adapter: adapter({
|
|
out: 'build',
|
|
precompress: true
|
|
}),
|
|
csrf: {
|
|
checkOrigin: false
|
|
}
|
|
}
|
|
};
|
|
|
|
export default config;
|