Fix origin validation for self-signed certificate deployments (#7882)
Use getWebServerName() for origin hostname comparison instead of directly comparing against certificates.CommonName. This ensures origin validation works correctly regardless of certificate type. Co-authored-by: Ashish Kunwar <ashishkunwar@Ashishs-Mac-mini.local> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Ashish Kunwar committed
Jun 8, 2026 at 20:30 UTC
f04c9f45dcfb6b66ffef801b84c869b54f33af20
1 file changed
+1
-2
webserver.js
+1
-2
@@ -6592,9 +6592,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6592
let originUrl; try { originUrl = new URL(req.headers.origin); } catch (ex) { return false; }
6593
if (!originUrl.hostname) return false; // Origin hostname is not valid
6594
if (Array.isArray(domain.allowedorigin)) return (domain.allowedorigin.indexOf(originUrl.hostname) >= 0); // Check if this is an allowed origin from an explicit list
6595
- if (obj.isTrustedCert(domain) === false) return true; // This server does not have a trusted certificate.
6595
if (domain.dns != null) return (domain.dns == originUrl.hostname); // Match the domain DNS
6597
- return (obj.certificates.CommonName == originUrl.hostname); // Match the default server name
6596
+ return (obj.getWebServerName(domain, req) == originUrl.hostname); // Match the server hostname
6597
}
6598
6599
// Create a OSX mesh agent installer