From f91b8a4bd44607b4cf271132f0b3505ba666f9a8 Mon Sep 17 00:00:00 2001 From: Catherine Renelle <32781029+catrenelle@users.noreply.github.com> Date: Thu, 26 Feb 2026 08:01:40 -0500 Subject: [PATCH] Fix tenant resolution: use Host header instead of ORIGIN-derived URL SvelteKit's event.url.hostname is always derived from the ORIGIN env var, so all requests resolved to the same tenant regardless of which domain the user visited. Now reads X-Forwarded-Host or Host header to get the actual domain for multi-tenant hostname isolation. Co-Authored-By: Claude Opus 4.6 --- src/hooks.server.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/hooks.server.ts b/src/hooks.server.ts index 94dc2e3..186114b 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -9,7 +9,13 @@ seedSystemTemplates().catch((e) => logger.error({ err: e }, 'Failed to seed syst export const handle: Handle = async ({ event, resolve }) => { const start = Date.now(); // 1. Resolve tenant from hostname - const hostname = event.url.hostname; + // Use the Host header (or X-Forwarded-Host behind a reverse proxy) + // instead of event.url.hostname, which is derived from the ORIGIN env var + // and doesn't reflect the actual domain the user visited. + const hostHeader = event.request.headers.get('x-forwarded-host') + || event.request.headers.get('host') + || event.url.hostname; + const hostname = hostHeader.split(':')[0]; const tenant = await resolveTenant(hostname); event.locals.tenant = tenant;