fix(security): tolerate Chromium stripping port from Origin header - #544
Open
LCZcoding wants to merge 1 commit into
Open
fix(security): tolerate Chromium stripping port from Origin header#544LCZcoding wants to merge 1 commit into
LCZcoding wants to merge 1 commit into
Conversation
Chromium 150+ omits the port from the Origin header for same-origin requests on non-default ports. The previous canonical-origin comparison (includes port) therefore rejected every legitimate pi-web API call, producing 'Error: HTTP 403' on the UI and an empty session sidebar. Compare origin hostnames only; the Host header is the authoritative source for where the request actually went, and the host allowlist still rejects DNS-rebinding and cross-loopback-name origins. Add tests covering loopback IP, LAN IP, and loopback name with the port stripped, plus regression tests for cross-name and DNS-rebind attacks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
isApiRequestOriginAllowed(lib/request-security.ts) rejects all/api/*requests with 403 on Chromium 150+, because Chrome now strips the port from
the
Originheader for same-origin requests on non-default ports, and thecanonical-origin comparison (which includes the port) no longer matches.
pi-web defaults to port 30141, so every fresh install using a modern
Chromium-based browser is affected: the UI shows
Error: HTTP 403, thesession sidebar appears empty, and the model config panel cannot load.
Fixes #542
Repro
npm install && npm run devon a fresh checkouthttp://127.0.0.1:30141in Chrome 150+/api/*request → status 403,response
{"error":"Untrusted API request"}Origin: http://127.0.0.1(no port) vsHost: 127.0.0.1:30141Fix
Compare Origin hostnames instead of full canonical origins. The
Hostheader is already validated by
isApiRequestHostAllowed, so portdifferences carry no trust signal — only hostname equality does.
Add
originHostname()helper and switchisApiRequestOriginAllowedto use hostname comparison.
Security
The Host allowlist,
sec-fetch-site, and same-origin checks stillblock DNS rebinding, cross-site fetches, opaque iframes, and cross
loopback-name origins (covered by new regression tests). The only
loosening is accepting same-hostname / different-port Origin headers,
which is the intended Chromium behavior.
Tests
allows same-origin requests when Chromium strips the port from Origin(covers loopback IP, LAN IP, loopback name)
still rejects when Origin hostname differs from Host even with port stripped(covers cross-loopback-name and DNS rebind)
Existing tests continue to pass.