apply security fix

apps/dashboard/src/middleware.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 
 const WEBSITE_URL = process.env.NEXT_PUBLIC_WEBSITE_URL ?? 'http://localhost:3000'
+const DASHBOARD_PUBLIC_URL = process.env.NEXT_PUBLIC_DASHBOARD_URL ?? `${WEBSITE_URL.replace(/\/$/, '')}/dashboard`
 const DASHBOARD_BASE_PATH = '/dashboard'
 
 function toDashboardAppPath(pathname: string): string {
@@ -29,26 +30,12 @@ function deduplicatePublicDashboardPath(pathname: string): string | null {
   return normalized || DASHBOARD_BASE_PATH
 }
 
-function resolveProxyUrl(req: NextRequest, pathname: string): URL {
-  const forwardedHost = req.headers.get('x-forwarded-host')
-  const forwardedProto = req.headers.get('x-forwarded-proto')
-  const websiteOrigin = new URL(WEBSITE_URL)
-
-  const url = new URL(pathname, req.nextUrl.origin)
-  if (forwardedHost && !isInternalHost(forwardedHost)) {
-    url.host = forwardedHost
-    url.protocol = (forwardedProto ?? 'http') + ':'
-    if (!hasExplicitPort(forwardedHost) || isInternalAppPort(url.port)) url.port = ''
-  } else if (!isInternalHost(req.nextUrl.host)) {
-    url.host = req.nextUrl.host
-    url.protocol = req.nextUrl.protocol
-    if (!hasExplicitPort(req.nextUrl.host) || isInternalAppPort(url.port)) url.port = ''
-  } else {
-    url.host = websiteOrigin.host
-    url.protocol = websiteOrigin.protocol
-    if (!hasExplicitPort(websiteOrigin.host) || isInternalAppPort(url.port)) url.port = ''
-  }
-  return url
+function resolveProxyUrl(_req: NextRequest, pathname: string): URL {
+  const canonicalDashboard = new URL(DASHBOARD_PUBLIC_URL)
+  const publicPath = pathname.startsWith(DASHBOARD_BASE_PATH)
+    ? pathname
+    : toPublicDashboardPath(pathname)
+  return new URL(publicPath, canonicalDashboard.origin)
 }
 
 function hasExplicitPort(host: string): boolean {