fb5165bb26
Opening the web app over the Mac's Wi-Fi address (an insecure context) crashed Connect because crypto.randomUUID is unavailable there, and the MCP OAuth redirect, Composio/Pipedream return and noVNC link all pointed at WEB_ORIGIN (127.0.0.1). The API now derives these URLs from the request's browser origin when it is loopback or a private network, the same hosts CORS already trusts, and falls back to WEB_ORIGIN otherwise. Claude-Session: https://claude.ai/code/session_01KWEAjTw26eRf3ZXTXfRjmD Co-authored-by: Claude <noreply@anthropic.com>
29 lines
1.2 KiB
TypeScript
29 lines
1.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { requestWebOrigin } from "./web-origin.js";
|
|
|
|
const configured = "http://127.0.0.1:5173";
|
|
|
|
describe("requestWebOrigin", () => {
|
|
it("follows a browser on loopback or a private network", () => {
|
|
expect(requestWebOrigin("http://192.168.0.20:5173", configured)).toBe(
|
|
"http://192.168.0.20:5173",
|
|
);
|
|
expect(requestWebOrigin("http://10.0.0.5:5173", configured)).toBe("http://10.0.0.5:5173");
|
|
expect(requestWebOrigin("http://mac.local:5173", configured)).toBe("http://mac.local:5173");
|
|
expect(requestWebOrigin("http://localhost:5173", configured)).toBe("http://localhost:5173");
|
|
});
|
|
|
|
it("keeps WEB_ORIGIN for public hosts, other schemes, and missing origins", () => {
|
|
expect(requestWebOrigin("https://attacker.example", configured)).toBe(configured);
|
|
expect(requestWebOrigin("rakazo://app", configured)).toBe(configured);
|
|
expect(requestWebOrigin("null", configured)).toBe(configured);
|
|
expect(requestWebOrigin(undefined, configured)).toBe(configured);
|
|
});
|
|
|
|
it("accepts the configured origin even when it is public", () => {
|
|
expect(requestWebOrigin("https://evoo.example", "https://evoo.example")).toBe(
|
|
"https://evoo.example",
|
|
);
|
|
});
|
|
});
|