@kb-labs/workflow-daemon 2.119.0-canary.cee505c72 → 2.119.0-canary.e120bc0ee

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.js +10 -3
  2. package/dist/index.js.map +1 -1
  3. package/package.json +22 -22
package/dist/index.js CHANGED
@@ -2783,9 +2783,16 @@ function registerWorkflowsAPI(options) {
2783
2783
  reply.hijack();
2784
2784
  const raw = reply.raw;
2785
2785
  const origin = request.headers.origin;
2786
- if (typeof origin === "string" && origin.startsWith("http://localhost")) {
2787
- raw.setHeader("Access-Control-Allow-Origin", origin);
2788
- raw.setHeader("Access-Control-Allow-Credentials", "true");
2786
+ if (typeof origin === "string") {
2787
+ try {
2788
+ const parsed = new URL(origin);
2789
+ const isLocalOrigin = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]");
2790
+ if (isLocalOrigin) {
2791
+ raw.setHeader("Access-Control-Allow-Origin", origin);
2792
+ raw.setHeader("Access-Control-Allow-Credentials", "true");
2793
+ }
2794
+ } catch {
2795
+ }
2789
2796
  }
2790
2797
  raw.setHeader("Content-Type", "text/event-stream");
2791
2798
  raw.setHeader("Cache-Control", "no-cache, no-transform");