From 6315020cc0c0b05c5df7ee87d2d295581f0a2135 Mon Sep 17 00:00:00 2001 From: KernelDeimos Date: Mon, 16 Jun 2025 18:16:18 -0400 Subject: [PATCH] dev: regex rules for undefined origin allowed This commit allows using a regex to specify a route that's allowed to not have an "Origin" header specified. This is necessary for parametized URLs. --- src/backend/src/modules/web/WebServerService.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/backend/src/modules/web/WebServerService.js b/src/backend/src/modules/web/WebServerService.js index 2eb09c78d..cb319b58b 100644 --- a/src/backend/src/modules/web/WebServerService.js +++ b/src/backend/src/modules/web/WebServerService.js @@ -518,7 +518,11 @@ class WebServerService extends BaseService { } // rules that don't apply to notification endpoints - if ( ! this.undefined_origin_allowed.includes(req.path) ) { + const undefined_origin_allowed = this.undefined_origin_allowed.some(rule => { + if ( typeof rule === 'string' ) return rule === req.path; + return rule.test(req.path); + }); + if ( ! undefined_origin_allowed ) { // check if no origin if ( req.method === 'POST' && req.headers.origin === undefined ) { event.allow = false;