puter/paseo
1
0
Fork 0
mirror of https://github.com/getpaseo/paseo.git synced 2026-07-29 12:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Support wildcard CORS in WebSocket verifyClient and dev.sh

Browse Source
This commit is contained in:
Mohamed Boudra
2026-04-10 10:45:36 +07:00
parent a692c616cb
commit 32fe4b3beb
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/server/src/server/websocket-server.ts
View File

@@ -396,7 +396,7 @@ export class VoiceAssistantWebSocketServer {
!!requestHost &&
(origin === `http://${requestHost}` || origin === `https://${requestHost}`);
if (!origin || allowedOrigins.has(origin) || sameOrigin) {
if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
callback(true);
} else {
this.incrementRuntimeCounter("originRejected");

5
scripts/dev.sh
View File

@@ -39,7 +39,10 @@ echo "════════════════════════
# through the daemon's Portless URL instead of a fixed localhost port.
APP_ORIGIN="$(portless get app)"
DAEMON_ENDPOINT="$(portless get daemon | sed -E 's#^https?://##')"
export PASEO_CORS_ORIGINS="${APP_ORIGIN}"
# Allow any origin in dev so Electron on random ports and Portless URLs all work.
# SECURITY: wildcard CORS is unsafe in production — only acceptable here because
# the daemon binds to localhost and this script is never used for production.
export PASEO_CORS_ORIGINS="*"
# Run both with concurrently
# BROWSER=none prevents auto-opening browser