Skip to content

fix: allow WSL2 172.x subnet in CORS origin whitelist #998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
web3dev1337 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix: allow WSL2 172.x subnet in CORS origin whitelist #998

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
17d76d6
fix: allow WSL2 172.x subnet in CORS origin whitelist
web3dev1337 Apr 7, 2026
0463993
fix: scope WSL2 CORS whitelist to the private 172.16.0.0/12 block
web3dev1337 Jul 18, 2026
7c2be67
feat: allow the remaining RFC1918 private ranges in the CORS whitelist
web3dev1337 Jul 18, 2026
abfd491
chore: use a generic example address in the CORS comment
web3dev1337 Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion server/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,15 @@ const io = new Server(httpServer, {
origin.startsWith('http://localhost:') ||
origin.startsWith('http://127.0.0.1:') ||
origin.startsWith('http://[::1]:') ||
origin.startsWith('http://100.');
origin.startsWith('http://100.') ||
// Private (RFC1918) ranges only — home/office LAN devices reaching the
// orchestrator via the Windows portproxy (phone, second PC) present
// origins like http://192.168.1.23:2080. A bare "172." prefix would
// also whitelist public internet space (e.g. Cloudflare/Google ranges
// in 172/8), so the 172 block is matched exactly (172.16-172.31).
/^http:\/\/172\.(1[6-9]|2\d|3[01])\./.test(origin) ||
origin.startsWith('http://192.168.') ||
origin.startsWith('http://10.');

if (allowed) {
callback(null, true);
Expand Down
Loading