fix(security): SSRF guard, header redaction, dashboard token gate

* server/utils/og.ts: resolve target host and block private/loopback/
  link-local/metadata IPs before fetching link previews; follow redirects
  manually so each hop is re-validated.
* server/utils/meta.ts: redact Cookie, Authorization and similar bearer
  headers before persisting visitor metadata, replacing values with a
  length stub so analysts still see the header was present.
* server/middleware/dashboard-auth.ts: gate every /api/* call behind
  HONEY_DASHBOARD_TOKEN; fail closed when the env var is unset unless
  HONEY_AUTH_DISABLED=1 is explicitly set for local development.
* .env.example: document the two new environment variables.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Disane87

.env.example

@@ -6,3 +6,13 @@ NUXT_PUBLIC_BASE_URL=https://honey.example.com
 # Outbound IP -> geo enrichment via ip-api.com (true/false).
 # Set to false to keep everything local with no outbound requests.
 NUXT_GEO_LOOKUP=true
+
+# Shared secret that gates every /api/* dashboard endpoint. Required in
+# production — without it the server returns 503 for all dashboard calls.
+# Clients send it as `Authorization: Bearer <token>`, `?token=<token>`, or
+# Cookie `honey_token=<token>`.
+HONEY_DASHBOARD_TOKEN=
+
+# Explicit opt-out for local development. Set to "1" to allow open access
+# without a token. NEVER set this in production.
+HONEY_AUTH_DISABLED=

server/middleware/dashboard-auth.ts

@@ -0,0 +1,50 @@
+/**
+ * Gates every /api/* dashboard endpoint behind a shared token. The honeypot
+ * streams victim PII (IPs, headers, cookies) so leaving these endpoints open
+ * to the internet is a data-protection problem.
+ *
+ * Set HONEY_DASHBOARD_TOKEN in the environment. Clients send it as either:
+ *   Authorization: Bearer <token>
+ *   ?token=<token>
+ *   Cookie: honey_token=<token>
+ *
+ * If the env var is unset, the server refuses every dashboard request — fail
+ * closed. Set HONEY_AUTH_DISABLED=1 to explicitly allow open access (dev only).
+ */
+
+const SAFE_PATHS = ['/api/_nuxt_icon']
+
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false
+  let r = 0
+  for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  return r === 0
+}
+
+export default defineEventHandler((event) => {
+  const path = event.path || ''
+  if (!path.startsWith('/api/')) return
+  if (SAFE_PATHS.some((p) => path.startsWith(p))) return
+
+  if (process.env.HONEY_AUTH_DISABLED === '1') return
+
+  const expected = process.env.HONEY_DASHBOARD_TOKEN
+  if (!expected) {
+    throw createError({
+      statusCode: 503,
+      statusMessage: 'Dashboard auth not configured (set HONEY_DASHBOARD_TOKEN)'
+    })
+  }
+
+  const auth = getRequestHeader(event, 'authorization') || ''
+  const bearer = auth.replace(/^Bearer\s+/i, '')
+  const provided =
+    (bearer && bearer !== auth ? bearer : '') ||
+    (getQuery(event).token as string | undefined) ||
+    getCookie(event, 'honey_token') ||
+    ''
+
+  if (!provided || !timingSafeEqual(provided, expected)) {
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+})

server/utils/meta.ts

@@ -86,6 +86,35 @@ async function geoLookup(ip: string): Promise<GeoInfo | undefined> {
   }
 }
 
+/**
+ * Header values too sensitive to persist verbatim. We keep the header name in
+ * the record (so analysts know it was sent) but replace the value with a
+ * length-stub. Visitors clicking traps from authenticated browsers will leak
+ * their session tokens here otherwise.
+ */
+const REDACTED_HEADERS = new Set([
+  'cookie',
+  'set-cookie',
+  'authorization',
+  'proxy-authorization',
+  'x-api-key',
+  'x-auth-token',
+  'x-csrf-token',
+  'x-xsrf-token'
+])
+
+function redactHeaders(headers: Record<string, string>): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const [name, value] of Object.entries(headers)) {
+    if (REDACTED_HEADERS.has(name.toLowerCase()) && value) {
+      out[name] = `[redacted ${value.length} chars]`
+    } else {
+      out[name] = value
+    }
+  }
+  return out
+}
+
 /**
  * Build a full Hit record from the incoming request. This is where all the
  * juicy honeypot metadata gets collected.
@@ -114,6 +143,6 @@ export async function buildHit(event: H3Event): Promise<Omit<Hit, 'id' | 'trapId
     geo,
     isBot: bot.isBot,
     botReason: bot.reason,
-    headers
+    headers: redactHeaders(headers)
   }
 }

server/utils/og.ts

@@ -1,8 +1,98 @@
+import { Resolver } from 'node:dns/promises'
+import { isIP } from 'node:net'
 import type { CustomPreview, OgData, OgTag } from './types'
 
 const FETCH_UA =
   'Mozilla/5.0 (compatible; hon.ey-link-preview/1.0; +https://github.com/) facebookexternalhit/1.1'
 
+const resolver = new Resolver()
+
+/**
+ * Reject loopback, link-local, cloud-metadata, and RFC1918 ranges so a malicious
+ * trap target cannot pivot fetchOgData into the host's internal network.
+ */
+function isPrivateAddress(addr: string): boolean {
+  const v = isIP(addr)
+  if (v === 4) {
+    const [a, b] = addr.split('.').map(Number)
+    if (a === 10) return true
+    if (a === 127) return true
+    if (a === 0) return true
+    if (a === 169 && b === 254) return true // link-local + AWS/GCP metadata
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+    if (a === 100 && b >= 64 && b <= 127) return true // CGNAT
+    if (a >= 224) return true // multicast + reserved
+    return false
+  }
+  if (v === 6) {
+    const lower = addr.toLowerCase()
+    if (lower === '::1' || lower === '::' || lower.startsWith('fe80:') || lower.startsWith('fc') || lower.startsWith('fd')) return true
+    if (lower.startsWith('::ffff:')) return isPrivateAddress(lower.slice(7))
+    if (lower.startsWith('2001:db8:')) return true
+    return false
+  }
+  return true
+}
+
+async function assertPublicHost(urlStr: string): Promise<void> {
+  let parsed: URL
+  try {
+    parsed = new URL(urlStr)
+  } catch {
+    throw new Error('Invalid URL')
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`Refusing non-http(s) scheme: ${parsed.protocol}`)
+  }
+  const host = parsed.hostname
+  if (!host) throw new Error('URL has no host')
+  if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local') || host.endsWith('.internal')) {
+    throw new Error(`Refusing internal host: ${host}`)
+  }
+
+  const literal = isIP(host)
+  if (literal) {
+    if (isPrivateAddress(host)) throw new Error(`Refusing private IP: ${host}`)
+    return
+  }
+
+  const addrs: string[] = []
+  for (const fn of ['resolve4', 'resolve6'] as const) {
+    try {
+      const r = await resolver[fn](host)
+      addrs.push(...r)
+    } catch {}
+  }
+  if (!addrs.length) throw new Error(`Could not resolve host: ${host}`)
+  for (const a of addrs) {
+    if (isPrivateAddress(a)) throw new Error(`Host ${host} resolves to private address ${a}`)
+  }
+}
+
+/**
+ * Follow redirects manually so each hop's hostname can be re-validated against
+ * the private-network blocklist. Native fetch with redirect:'follow' would let
+ * an attacker bounce us from a public host into 169.254.169.254.
+ */
+async function safePublicFetch(url: string, init: RequestInit & { maxRedirects?: number }): Promise<Response> {
+  const max = init.maxRedirects ?? 5
+  let current = url
+  const { maxRedirects: _omit, ...passthrough } = init
+  for (let i = 0; i <= max; i++) {
+    await assertPublicHost(current)
+    const res = await fetch(current, { ...passthrough, redirect: 'manual' })
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get('location')
+      if (!loc) return res
+      current = new URL(loc, current).toString()
+      continue
+    }
+    return res
+  }
+  throw new Error('Too many redirects')
+}
+
 /** Which meta tags are worth cloning for a link preview. */
 function wantMeta(attr: 'property' | 'name', key: string): boolean {
   const k = key.toLowerCase()
@@ -56,9 +146,8 @@ export async function fetchOgData(targetUrl: string): Promise<OgData> {
   try {
     const controller = new AbortController()
     const t = setTimeout(() => controller.abort(), 8000)
-    const res = await fetch(targetUrl, {
+    const res = await safePublicFetch(targetUrl, {
       headers: { 'User-Agent': FETCH_UA, Accept: 'text/html,application/xhtml+xml' },
-      redirect: 'follow',
       signal: controller.signal
     }).finally(() => clearTimeout(t))