onion rules

src/inc/lib.mjs

@@ -460,4 +460,14 @@ export default new class {
     console.error(`[ERROR REF ${errId}] ${context}:`, err);
     return `Internal Error. Reference: ${errId}`;
   }
+
+  isOnionRequest(req) {
+    if (!req || !req.headers) return false;
+    const rawHost = req.headers['x-forwarded-host'] || req.headers['host'] || '';
+    if (!rawHost) return false;
+    const firstHost = rawHost.split(',')[0].trim();
+    const hostNoPort = firstHost.split(':')[0].trim().toLowerCase();
+    return hostNoPort.endsWith('.onion');
+  }
 };
+

src/inc/routes/register.mjs

@@ -89,7 +89,7 @@ export default (router, tpl) => {
         }
 
         // reCAPTCHA verification (bypassed for .onion requests as Google reCAPTCHA cannot validate .onion domains)
-        const isOnion = req.headers['host']?.endsWith('.onion');
+        const isOnion = lib.isOnionRequest(req);
         if (!isOnion && cfg.recaptcha?.enabled && cfg.recaptcha?.secret_key) {
             const rcToken = req.post['g-recaptcha-response'];
             if (!rcToken) return renderError("Please complete the reCAPTCHA.");