IDE version initial - #73
Open
urstrulykkr wants to merge 8 commits into
Open
Conversation
Connecting to a VM through the SSH tunnel failed with "Request failed with status code 403" as soon as the user tried to log in. The tunnel serves the web app from http://127.0.0.1:<sticky port>, not the VM's hostname, and a self-host deployment that sets CORS_ALLOWED_ORIGINS to its public hostname replaces the built-in list rather than extending it. Spring treats any request carrying Origin as cross-origin (the same-origin short-circuit went away in 5.3), so the backend answered 403 with the plain-text body "Invalid CORS request". That body has no `message` field, so client.js's axios interceptor fell through to axios's own wording — an error naming neither CORS nor the origin. It hid well: Chromium omits Origin on same-origin GETs, so the health probe, the SPA and every read succeeded and the connection tested green. Only the first POST — the login — failed. - probe.js sends an Origin header, so the rejection is caught at connect time rather than at the user's first login, and transport.js reports it as `cors-rejected` naming the origin and the exact allowlist to set. - Loopback entries in the shipped defaults now carry a port wildcard, since the tunnel's local port is chosen at runtime. Legal only because SecurityConfig uses setAllowedOriginPatterns. - .env.example, docker-compose.yml and desktop/README.md spell out that CORS_ALLOWED_ORIGINS replaces the list, which is how the loopback entries go missing. - CLAUDE.md and config.js drop the "zero backend changes" claim: CORS is the one setting the thin client does require. - tunnel-selftest.js grows two checks (14/14) covering the Origin header and a 403 from an allowlist that omits the origin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
|
@urstrulykkr Pl check the code scanning failures. |
…e validation' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
venkateshsakamuri-lab
previously approved these changes
Aug 23, 2026
Align AGENTS.md, SELF_HOST_GUIDE, and root README with desktop/README.md: keep loopback CORS wildcards when setting a public origin, link Desktop install, and document Node 22 / tunnel prerequisites. Match SecurityConfig @value fallback to application.properties port wildcards. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IDE Version 1.0.0