fix: validate LNURL request targets and responses - #3597

Open

reneaaron wants to merge 9 commits into

fix/lnurl-request-target-validation

Commits on Aug 24, 2026

fix: validate and restrict LNURL request targets
reneaaron
committed
12b3a10
fix: harden LNURL host validation for IPv6 and keep service error text
reneaaron
committed
eaf4d1f
fix: scope LNURL endpoint restrictions to website-supplied LNURLs
reneaaron
committed
fb0deb8

Commits on Sep 8, 2026

refactor: classify LNURL hosts with ipaddr.js instead of a hand-rolled parser
reneaaron
committed
178fb2c
Merge branch 'master' into fix/lnurl-request-target-validation
reneaaron
authored
9159d70
refactor: check LNURL targets once, at the website entry point
reneaaron
committed
f9366a3
fix: apply the LNURL host check to page-advertised LNURLs and trim callback replies
reneaaron
committed
a8ab694
fix: require https for website-supplied LNURLs and callbacks
reneaaron
committed
da3a036
fix: require https for page-advertised LNURLs and translate the error
reneaaron
committed
871a72f