mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-09-07 15:07:17 +00:00
Tobias Gesellchen
ca50451f9c
Gorilla's default same-origin CheckOrigin compares Origin and Host as raw strings, port included. This repo's own documented nginx reverse- proxy config forwards a portless Host header (nginx's $host never includes the port, unlike $http_host) regardless of what public port the proxy listens on. That's harmless on the scheme's default port (the browser's Origin also omits it there), but on a non-default public port (e.g. :8443, a realistic multi-service-hosting shape) the browser's Origin keeps the port while the forwarded Host doesn't -- gorilla's strict compare then 403s every WebSocket handshake, silently breaking the player's live updates in a deployment topology the docs actively recommend. Add checkWebSocketOrigin/sameHostIgnoringPort: gorilla's own default policy, but comparing hostname only. Same-origin and cross-hostname behavior is unchanged; only a port mismatch on an otherwise-matching hostname is now tolerated. Also extracted newTestWebSocketServer, shared by dialTestWebSocket and the origin-policy test, instead of the origin test re-implementing the same httptest scaffolding inline. Found in code review of PR #669 (findings #1, #2).