mirror of
https://github.com/browseros-ai/BrowserOS.git
synced 2026-05-13 15:46:22 +00:00
dde403962f
* fix(server): tighten CORS allowlist for the agent server Replace the permissive `origin || '*'` reflection in `defaultCorsConfig` with an explicit allowlist composed of: - a static list (empty by default) - comma-separated origins from `BROWSEROS_TRUSTED_ORIGINS` Add a small `requireTrustedOrigin` middleware that actively rejects (403) any request whose `Origin` header is present and not in the allowlist. The middleware is permissive when the `Origin` header is absent — CLI tools, internal Node clients, and some service-worker fetches legitimately omit it; the threat model only covers cross-origin browser fetches, which always carry `Origin` (it's on the Forbidden Header List, so JS cannot suppress it). Mount the middleware globally in `createHttpServer` after the existing `cors()` layer. Document the new env var in `.env.example`. Tests cover allowlist parsing (empty, single, multi, trims, case sensitivity, port match) and middleware behaviour (missing Origin allowed, allowlisted Origin allowed, unknown Origin rejected, "null" rejected, port mismatch rejected, disallowed Origin doesn't reach the handler). * fix(server): include published extension origin in default allowlist Pin the published BrowserOS extension origin in the static allowlist so the default install accepts the legitimate extension without requiring `BROWSEROS_TRUSTED_ORIGINS` to be populated. Additional origins (dev / alpha) keep working through the env override. * chore(server): trim .env.example comments * chore(server): drop redundant comments from cors helpers
30 lines
546 B
Plaintext
30 lines
546 B
Plaintext
# Ports
|
|
BROWSEROS_CDP_PORT=9000
|
|
BROWSEROS_SERVER_PORT=9100
|
|
BROWSEROS_EXTENSION_PORT=9300
|
|
|
|
# Directories (optional - defaults to cwd)
|
|
# BROWSEROS_RESOURCES_DIR=./resources
|
|
# BROWSEROS_EXECUTION_DIR=./out
|
|
|
|
# BrowserOS config
|
|
BROWSEROS_CONFIG_URL=https://llm.browseros.com/api/browseros-server/config
|
|
BROWSEROS_VERSION=
|
|
BROWSEROS_INSTALL_ID=
|
|
BROWSEROS_CLIENT_ID=
|
|
|
|
BROWSEROS_TRUSTED_ORIGINS=
|
|
|
|
# Graph service
|
|
CODEGEN_SERVICE_URL=
|
|
|
|
# Telemetry
|
|
POSTHOG_API_KEY=
|
|
SENTRY_DSN=
|
|
|
|
NODE_ENV=development
|
|
LOG_LEVEL=info
|
|
|
|
# Testing
|
|
BROWSEROS_TEST_HEADLESS=false
|