From 394b9cac13ca13645e3e756bdb8e57510b58afcb Mon Sep 17 00:00:00 2001 From: Mohamed Boudra Date: Fri, 27 Mar 2026 21:40:02 +0700 Subject: [PATCH] fix: hardcode paseo://app as allowed CORS origin in daemon bootstrap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The desktop app uses the paseo:// custom protocol scheme, but the origin was only passed via PASEO_CORS_ORIGINS when the desktop started the daemon itself. If the daemon was started by the CLI, the origin was missing and the Electron renderer's WebSocket connection was rejected. Also removes file:// and null from allowed origins — any page loaded via file:// could connect to the daemon, which is a security gap. --- packages/desktop/src/daemon/daemon-manager.ts | 2 -- packages/server/src/server/bootstrap.ts | 5 ++--- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/packages/desktop/src/daemon/daemon-manager.ts b/packages/desktop/src/daemon/daemon-manager.ts index d678662c8..57e1f79ad 100644 --- a/packages/desktop/src/daemon/daemon-manager.ts +++ b/packages/desktop/src/daemon/daemon-manager.ts @@ -148,8 +148,6 @@ function buildDesktopDaemonCorsOriginsEnv(): string | undefined { .filter((value) => value.length > 0), ); - origins.add("paseo://app"); - const devServerUrl = process.env.EXPO_DEV_URL ?? DEFAULT_ELECTRON_DEV_SERVER_URL; try { const parsed = new URL(devServerUrl); diff --git a/packages/server/src/server/bootstrap.ts b/packages/server/src/server/bootstrap.ts index b00bde3cb..06f45ca61 100644 --- a/packages/server/src/server/bootstrap.ts +++ b/packages/server/src/server/bootstrap.ts @@ -249,9 +249,8 @@ export async function createPaseoDaemon( // CORS - allow same-origin + configured origins const allowedOrigins = new Set([ ...config.corsAllowedOrigins, - // Packaged desktop renderers may send `file://` or `null` as the origin. - "file://", - "null", + // Packaged desktop renderers use the custom paseo:// protocol scheme. + "paseo://app", // For TCP, add localhost variants ...(listenTarget.type === "tcp" ? [