github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-07-15 22:54:03 -05:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[PR #8032] Skip Enable Banking PSU headers for local IPs #131675

New Issue
Open
opened 2026-06-16 00:24:24 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-16 00:24:24 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/actualbudget/actual/pull/8032
Author: @Nustinua
Created: 6/2/2026
Status: 🔄 Open

Base: master ← Head: enablebanking-skip-private-psu-headers

📝 Commits (10+)

  • 40abfaf Skip Enable Banking PSU headers for local IPs
  • 4540237 Add release note for Enable Banking PSU headers
  • f5c2f76 Include IPv4 link-local addresses in PSU header filter
  • e411965 Use trusted proxy resolved IP for Enable Banking PSU headers
  • 11e2ba0 Avoid logging Enable Banking PSU header values
  • 9adc4a7 Use shared SSRF helper for Enable Banking PSU headers
  • 8bc12d1 Fix space
  • 9e05911 Merge branch 'master' into enablebanking-skip-private-psu-headers
  • a84b46d Add shared SSRF helper for Enable Banking PSU headers
  • ec346e3 Use public IP in Enable Banking PSU header test

📊 Changes

5 files changed (+304 additions, -8 deletions)

View changed files

📝 packages/sync-server/src/app-enablebanking/app-enablebanking.ts (+16 -3)
📝 packages/sync-server/src/app-enablebanking/tests/poll-auth.spec.ts (+2 -5)
➕ packages/sync-server/src/util/ssrf.test.ts (+162 -0)
➕ packages/sync-server/src/util/ssrf.ts (+118 -0)
➕ upcoming-release-notes/8032.md (+6 -0)

📄 Description

Skips forwarding Enable Banking PSU headers when the detected PSU IP address is local or private.

Some ASPSPs reject data requests when a private LAN IP such as 10.x.x.x is sent as Psu-Ip-Address. In local/self-hosted setups, req.ip may be a private address, which is not useful to the ASPSP.

The change keeps forwarding PSU headers when a public client IP is available via CF-Connecting-IP, X-Real-IP, X-Forwarded-For, or req.ip, but returns no PSU headers for local/private IPs.

Tested:

  • reproduced Enable Banking ASPSP_ERROR with Psu-Ip-Address set to 10.25.25.52
  • verified logs show PSU headers are skipped for the private IP
  • verified HVB balances and transactions requests succeed after skipping private PSU headers
  • ran yarn typecheck

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/actualbudget/actual/pull/8032 **Author:** [@Nustinua](https://github.com/Nustinua) **Created:** 6/2/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `enablebanking-skip-private-psu-headers` --- ### 📝 Commits (10+) - [`40abfaf`](https://github.com/actualbudget/actual/commit/40abfafb6218166783bd41d9057986ffe97c71cd) Skip Enable Banking PSU headers for local IPs - [`4540237`](https://github.com/actualbudget/actual/commit/4540237f7a4a064fd49498d4ea356b4c0b002d5d) Add release note for Enable Banking PSU headers - [`f5c2f76`](https://github.com/actualbudget/actual/commit/f5c2f766aba65674d507e2fc882ee7a062e4596b) Include IPv4 link-local addresses in PSU header filter - [`e411965`](https://github.com/actualbudget/actual/commit/e4119658951684bddcb483b29fd8ac1b59f62bff) Use trusted proxy resolved IP for Enable Banking PSU headers - [`11e2ba0`](https://github.com/actualbudget/actual/commit/11e2ba0fb321237fbdb4b42517870bdf764bd994) Avoid logging Enable Banking PSU header values - [`9adc4a7`](https://github.com/actualbudget/actual/commit/9adc4a7388e6759c26fca71ac589a8528e70537f) Use shared SSRF helper for Enable Banking PSU headers - [`8bc12d1`](https://github.com/actualbudget/actual/commit/8bc12d156c93b28c29b0221694b76b9e55228013) Fix space - [`9e05911`](https://github.com/actualbudget/actual/commit/9e059118ebf40414756343a9820c05d087866d24) Merge branch 'master' into enablebanking-skip-private-psu-headers - [`a84b46d`](https://github.com/actualbudget/actual/commit/a84b46d3e6fc562559303d1bd8b981181cbba582) Add shared SSRF helper for Enable Banking PSU headers - [`ec346e3`](https://github.com/actualbudget/actual/commit/ec346e3046d3a6ddb8218b220f86ae6f53420542) Use public IP in Enable Banking PSU header test ### 📊 Changes **5 files changed** (+304 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `packages/sync-server/src/app-enablebanking/app-enablebanking.ts` (+16 -3) 📝 `packages/sync-server/src/app-enablebanking/tests/poll-auth.spec.ts` (+2 -5) ➕ `packages/sync-server/src/util/ssrf.test.ts` (+162 -0) ➕ `packages/sync-server/src/util/ssrf.ts` (+118 -0) ➕ `upcoming-release-notes/8032.md` (+6 -0) </details> ### 📄 Description Skips forwarding Enable Banking PSU headers when the detected PSU IP address is local or private. Some ASPSPs reject data requests when a private LAN IP such as 10.x.x.x is sent as Psu-Ip-Address. In local/self-hosted setups, req.ip may be a private address, which is not useful to the ASPSP. The change keeps forwarding PSU headers when a public client IP is available via CF-Connecting-IP, X-Real-IP, X-Forwarded-For, or req.ip, but returns no PSU headers for local/private IPs. Tested: - reproduced Enable Banking ASPSP_ERROR with Psu-Ip-Address set to 10.25.25.52 - verified logs show PSU headers are skipped for the private IP - verified HVB balances and transactions requests succeed after skipping private PSU headers - ran yarn typecheck --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-16 00:24:24 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#131675
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?