BuzzbeeSCD/openchamber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: authenticate terminal WebSockets synchronously on Bun

Browse Source
This commit is contained in:
Bohdan Triapitsyn
2026-09-03 11:49:34 +03:00
parent e885afbe89
commit dfb3c614c8
4 changed files with 57 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/web/server/lib/security/request-security.js
+10 -4
View File
@@ -103,7 +103,7 @@ export const createRequestSecurityRuntime = (deps) => {
return { origins, hosts };
};
const isRequestOriginAllowed = async (req) => {
const isRequestOriginAllowed = (req) => {
const originHeader = typeof req.headers.origin === 'string' ? req.headers.origin.trim() : '';
if (!originHeader) {
return false;
@@ -120,15 +120,21 @@ export const createRequestSecurityRuntime = (deps) => {
return false;
}
const candidates = await getRequestOriginCandidates(req);
if (candidates.origins.has(origin.origin)) return true;
const forwardedHostHeader = req.headers['x-forwarded-host'];
const forwardedHost = (Array.isArray(forwardedHostHeader) ? forwardedHostHeader[0] : forwardedHostHeader || '')
.split(',')[0].trim().toLowerCase();
const hostHeader = req.headers.host;
const host = forwardedHost || (Array.isArray(hostHeader) ? hostHeader[0] : hostHeader || '').trim().toLowerCase();
if (host && host === origin.host.toLowerCase()) return true;
// TLS commonly ends at a cloud edge before an HTTP hop to OpenChamber.
// In that setup the browser's Origin is https while a generic reverse
// proxy reports the upstream request as http. The external host remains
// authoritative, so compare it directly instead of requiring the proxy to
// preserve the browser-facing protocol.
return candidates.hosts.has(origin.host.toLowerCase());
return getRequestOriginCandidates(req).then((candidates) => (
candidates.origins.has(origin.origin) || candidates.hosts.has(origin.host.toLowerCase())
));
};
return {