From 22250ad42e2c1262e1e1039d00539ffe61cf1b42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Graber?= Date: Mon, 23 Mar 2026 11:05:18 -0400 Subject: [PATCH] shared/ws: Remove CheckOrigin bypass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We've apparently always turned off this particular safety check but can't find a good reason for that as all complex Websocket operations are done outside of the browser. For browser-based interactions, the default behavior of enforcing an Origin match seems quite appropriate. Reported-by: https://7asecurity.com Signed-off-by: Stéphane Graber --- shared/ws/upgrader.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/shared/ws/upgrader.go b/shared/ws/upgrader.go index fd434c5c00..bc54748d9d 100644 --- a/shared/ws/upgrader.go +++ b/shared/ws/upgrader.go @@ -1,7 +1,6 @@ package ws import ( - "net/http" "time" "github.com/gorilla/websocket" @@ -9,6 +8,5 @@ import ( // Upgrader is a websocket upgrader which ignores the request Origin. var Upgrader = websocket.Upgrader{ - CheckOrigin: func(_ *http.Request) bool { return true }, HandshakeTimeout: time.Second * 5, }