shihaam
aeb59e8eda
Build self-hosted HTTP Toolkit / build (linux-x64, ubuntu-latest, true) (push) Canceled after 0s
Build self-hosted HTTP Toolkit / build (macos-arm64, macos-latest, true) (push) Canceled after 0s
Build self-hosted HTTP Toolkit / build (windows-x64, windows-latest, false) (push) Canceled after 0s
Build self-hosted HTTP Toolkit / release (push) Canceled after 0s
23 lines
1.0 KiB
Diff
23 lines
1.0 KiB
Diff
diff --git a/src/constants.ts b/src/constants.ts
|
|
index 8d295cc..16f02db 100644
|
|
--- a/src/constants.ts
|
|
+++ b/src/constants.ts
|
|
@@ -8,10 +8,13 @@ export const APP_ROOT = path.join(__dirname, '..');
|
|
|
|
export const ALLOWED_ORIGINS = IS_PROD_BUILD
|
|
? [
|
|
- // Prod builds only allow HTTPS app.httptoolkit.tech usage. This
|
|
- // ensures that no other sites/apps can communicate with your server
|
|
- // whilst you have the app open. If they could (requires an HTTP mitm),
|
|
- // they would be able to start proxies & interceptors.
|
|
+ // Self-hosted build: the UI is served locally by this same binary, so we
|
|
+ // must allow localhost origins here (upstream prod allows only
|
|
+ // app.httptoolkit.tech). This matches upstream's *dev* allowlist. Trade-off:
|
|
+ // any local http page could talk to the server while it's running.
|
|
+ /^https?:\/\/localhost(:\d+)?$/,
|
|
+ /^https?:\/\/127\.0\.0\.\d+(:\d+)?$/,
|
|
+ /^http:\/\/local\.httptoolkit\.tech(:\d+)?$/,
|
|
/^https:\/\/app\.httptoolkit\.tech$/
|
|
]
|
|
: [
|