Maurice bd5a6cc748 fix(cors): the instance's own address no longer trips ALLOWED_ORIGINS ...

With ALLOWED_ORIGINS set, every request carrying an Origin that was not on
the list was failed with an unhandled error, which the exception filter
answered with a 500. A browser sends Origin on every POST and WebSocket
upgrade, including same-origin ones, so opening TREK under any address the
list did not name (the LAN IP, a second hostname, http instead of https)
broke the login with "Internal Server Error" while another browser that
used the listed address worked.

A request whose Origin is the host it was sent to is now treated as
same-origin and always passes, for REST and the /ws upgrade alike. A
foreign origin is still refused, now with a 403 "Not allowed by CORS" and a
warning in the log naming the origin to add.

Closes #2543

2026-09-29 21:16:26 +02:00

..

globalMiddleware.ts

fix(cors): the instance's own address no longer trips ALLOWED_ORIGINS

2026-09-29 21:16:26 +02:00