@abir-taheerchecks…abir/dashboard-api-key-endpoints → production1 files · +45 −21review: @sohamganatrareview: @kaavee315review: @anshugarg15updated 2w agoHarden the dashboard JWT issuer validation to prevent SSRF attacks. The iss claim was used to build the JWKS fetch URL — an attacker could set it to an internal URL (e.g. cloud metadata endpoint) and trigger server-side requests.
iss value)extractDomainFromUrl helperAlso includes prior commits:
getDashboardRouter() as standard auth mode (addresses CryogenicPlanet's review)http://, IPs, ports, paths, query strings🤖 Generated with Claude Code
