.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.md

.forge/issues/ac514078-d6b2-4e59-94d0-00c523e41936/issue.md 1.2 KiB 38 lines Raw

id: ac514078-d6b2-4e59-94d0-00c523e41936 title: serve same-origin gate ignores port and scheme state: closed labels:

kind:security assignees: [] milestone: null created: 2026-10-27T18:08:32.890435135Z updated: 2026-10-27T18:20:51.821838165Z

What

The local serve same-origin gate compares only hostnames; it discards scheme and port.

src/serve.rs:599-658: host_of_url() strips :port; origin_allowed() compares want == got.

Reproduced

Run hu13 serve on 127.0.0.1:39333, then:

curl -X POST \
  -H 'Origin: http://127.0.0.1:9999' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'title=Hello&body=World&license=agree' \
  http://127.0.0.1:39333/inbox/issue

Response is 200 and a submission is stored. A browser page on a different local port (or different scheme) can therefore POST to the inbox, even though the Pages Function compares .host including the port.

Impact

Cross-origin POST/CSRF bypasses the browser same-origin gate; local/Pages behavior differs.

Fix

Compare normalized scheme + host + port (handle default ports), not just the hostname. Add tests for same host/different port and different scheme; keep the curl no-Origin path.

view raw