jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Support wildcard CORS in WebSocket verifyClient and dev.sh

Browse Source
This commit is contained in:
Mohamed Boudra
2026-04-10 10:45:36 +07:00
parent a692c616cb
commit 32fe4b3beb
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/server/websocket-server.ts
+1 -1
View File
@@ -396,7 +396,7 @@ export class VoiceAssistantWebSocketServer {
!!requestHost && !!requestHost &&
(origin === `http://${requestHost}` || origin === `https://${requestHost}`); (origin === `http://${requestHost}` || origin === `https://${requestHost}`);
if (!origin || allowedOrigins.has(origin) || sameOrigin) { if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
callback(true); callback(true);
} else { } else {
this.incrementRuntimeCounter("originRejected"); this.incrementRuntimeCounter("originRejected");
scripts/dev.sh
+4 -1
View File
@@ -39,7 +39,10 @@ echo "════════════════════════
# through the daemon's Portless URL instead of a fixed localhost port. # through the daemon's Portless URL instead of a fixed localhost port.
APP_ORIGIN="$(portless get app)" APP_ORIGIN="$(portless get app)"
DAEMON_ENDPOINT="$(portless get daemon | sed -E 's#^https?://##')" DAEMON_ENDPOINT="$(portless get daemon | sed -E 's#^https?://##')"
export PASEO_CORS_ORIGINS="${APP_ORIGIN}" # Allow any origin in dev so Electron on random ports and Portless URLs all work.
# SECURITY: wildcard CORS is unsafe in production — only acceptable here because
# the daemon binds to localhost and this script is never used for production.
export PASEO_CORS_ORIGINS="*"
# Run both with concurrently # Run both with concurrently
# BROWSER=none prevents auto-opening browser # BROWSER=none prevents auto-opening browser