cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity

Fix tenant resolution: use Host header instead of ORIGIN-derived URL

Browse Source 
SvelteKit's event.url.hostname is always derived from the ORIGIN env
var, so all requests resolved to the same tenant regardless of which
domain the user visited. Now reads X-Forwarded-Host or Host header
to get the actual domain for multi-tenant hostname isolation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Catherine Renelle
2026-02-26 08:01:40 -05:00
parent 606c1b0652
commit f91b8a4bd4
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/hooks.server.ts
+7 -1
View File
@@ -9,7 +9,13 @@ seedSystemTemplates().catch((e) => logger.error({ err: e }, 'Failed to seed syst
export const handle: Handle = async ({ event, resolve }) => { export const handle: Handle = async ({ event, resolve }) => {
const start = Date.now(); const start = Date.now();
// 1. Resolve tenant from hostname // 1. Resolve tenant from hostname
const hostname = event.url.hostname; // Use the Host header (or X-Forwarded-Host behind a reverse proxy)
// instead of event.url.hostname, which is derived from the ORIGIN env var
// and doesn't reflect the actual domain the user visited.
const hostHeader = event.request.headers.get('x-forwarded-host')
|| event.request.headers.get('host')
|| event.url.hostname;
const hostname = hostHeader.split(':')[0];
const tenant = await resolveTenant(hostname); const tenant = await resolveTenant(hostname);
event.locals.tenant = tenant; event.locals.tenant = tenant;