---
id: ac514078-d6b2-4e59-94d0-00c523e41936
title: serve same-origin gate ignores port and scheme
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T18:08:32.890435135Z
updated: 2026-10-27T18:20:51.821838165Z
---
## What

The local `serve` same-origin gate compares only hostnames; it discards scheme and port.

`src/serve.rs:599-658`: `host_of_url()` strips `:port`; `origin_allowed()` compares `want == got`.

## Reproduced

Run `hu13 serve` on `127.0.0.1:39333`, then:

```
curl -X POST \
  -H 'Origin: http://127.0.0.1:9999' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'title=Hello&body=World&license=agree' \
  http://127.0.0.1:39333/inbox/issue
```

Response is `200` and a submission is stored. A browser page on a different local port (or different scheme) can therefore POST to the inbox, even though the Pages Function compares `.host` including the port.

## Impact

Cross-origin POST/CSRF bypasses the browser same-origin gate; local/Pages behavior differs.

## Fix

Compare normalized scheme + host + port (handle default ports), not just the hostname. Add tests for same host/different port and different scheme; keep the curl no-Origin path.