1.3 KiB
1.3 KiB
v0.3.1 (2026-05-25)
Hotfix for the v0.3.0 production-readiness release: the new WebSocket Origin allow-list rejected same-origin connections from any LAN IP, breaking the Web UI on host: 0.0.0.0 deployments unless cors_origins was explicitly configured.
Bug Fixes
- WebSocket Origin check now accepts same-origin connections. When
cors_originsis unset, the default allow-list was hard-coded tohttp://localhost:<port>+http://127.0.0.1:<port>, so a browser opening the UI via the LAN IP (e.g.http://192.168.2.100:8765) had its WebSocket closed with code 4003 ("Origin not allowed") and never recovered. The endpoint now also accepts anyOriginwhose authority matches the request'sHostheader (with eitherhttp://orhttps://scheme) — same-origin connections are by definition not CSWSH, so the cross-origin defence introduced in v0.3.0 is preserved. (9b9a2b5)
All Commits
| Hash | Message | Author |
|---|---|---|
| 9b9a2b5 | fix(ws): accept same-origin WebSocket connections in default Origin allow-list | alexei.dolgolyov |