Secure profile photo uploads and trust configured production origin

lib/request-origin.ts

@@ -40,7 +40,14 @@ export function requestOrigin(
   // A different configured host must not redirect a LAN login to localhost.
   if (websiteUrl) {
     const configured = parseOrigin(websiteUrl);
-    if (configured.host === direct.host) return configured.origin;
+    // In production MINEGEO_URL is required and is the trust anchor. Never let
+    // an untrusted Host header choose an OAuth callback or pass the CSRF check.
+    // Development keeps the direct-host fallback for LAN testing.
+    if (
+      configured.host === direct.host ||
+      process.env.NODE_ENV === "production"
+    )
+      return configured.origin;
   }
   return direct.origin;
 }
@@ -63,7 +70,9 @@ export function verifyOrigin(
     if (parsed.pathname !== "/" || parsed.search || parsed.hash) {
       throw new Error("Invalid request origin");
     }
-    const allowed = new Set([requestOrigin(request)]);
+    const allowed = new Set([
+      requestOrigin(request, configuration.websiteUrl),
+    ]);
     for (const value of [
       configuration.websiteUrl,
       ...(configuration.additionalOrigins?.split(",") ?? []),