@statewalker/httpeers-share 0.2.1 → 0.3.0

package/README.md

@@ -10,7 +10,7 @@ Sharing an HTTP service with the members of an httpeers mesh. It covers:
 - how they are invited (invite links);
 - what a failed join means (join outcome).
 
-`./bridge` is the PeerShare Bridge, for Node and Bun only.
+`./bridge` is the PeerShare Bridge, for Node, Bun and Deno.
 
 ## Why it exists
 
@@ -34,7 +34,7 @@ pnpm add @statewalker/httpeers-share
 | `.` | `encodeInvite`, `decodeInvite` | anywhere | 06 |
 | `.` | `joinOutcome`, `revokeGuest`, `isSharerOffline`, `stampGuest` | anywhere | 09, 10, 16 |
 | `.` | `openTunnel`, `sharerSocket`, `encodeFrame`/`decodeFrames`: a WebSocket inside one full-duplex mesh request | anywhere | 15 |
-| `./bridge` | `createBridge` (HTTP and its WebSocket gate), `listenLoopback` (Node), `connectApp`/`relaySocket` (for a Bun host) | Node, Bun | 02, 03, 16 |
+| `./bridge` | `createBridge` (HTTP and its WebSocket gate), `originAllowed`, `listenLoopback`, `connectApp`/`relaySocket` (for another server) | Node, Bun, Deno | 02, 03, 16 |
 
 ## Examples
 
@@ -54,6 +54,19 @@ const mount = serviceTable(
 ); // the Sharer's `/s` mount
 ```
 
+```ts
+import { createBridge, listenLoopback } from "@statewalker/httpeers-share/bridge";
+
+const bridge = await listenLoopback(
+  createBridge({
+    token: "", // no key: any allowed page may use it
+    allowedOrigins: ["https://peershare.httpeers.net", "http://localhost:*", "http://127.0.0.1:*"],
+  }),
+  9090,
+);
+bridge.origin; // "http://127.0.0.1:9090"
+```
+
 ## Internals
 
 - The root entry point is isomorphic. `tests/boundary.test.ts` fails if any file under `src/`
@@ -63,6 +76,26 @@ const mount = serviceTable(
 - `service-table`, `join-outcome` and `stamp-guest` were tested over the mesh in the rungs.
   Their unit tests here characterise code that moved, and passed on their first run.
 
+- **Who may call the Bridge.** It listens on 127.0.0.1 only, but a loopback port that answers
+  cross-origin requests is reachable from every website the Sharer visits. So a request whose
+  `Origin` is not in `allowedOrigins` gets `403` with `x-peershare-bridge: origin-forbidden` and
+  no CORS grant, on HTTP and WebSocket alike. A pattern is an exact origin, `scheme://host:*`
+  (that host on any port; compared as a parsed URL, so `http://localhost.evil.com` does not
+  match `http://localhost:*`) — on any port, or none — or `*`, every site (`Origin: null`,
+  sandboxed frames and `file://` pages, included). A request with no `Origin` is a local
+  process, admitted by the token alone.
+- **Only loopback names.** A request whose `Host` is not `127.0.0.1`, `localhost` or `[::1]`
+  gets `403` `host-forbidden`. That is DNS rebinding: a website rebinds its own name to
+  127.0.0.1, its requests become same-origin and carry no `Origin`, and without this check an
+  empty token would let it relay anywhere and read the answers.
+- **The token is optional.** `token: ""` checks no token, so the origin list is the only guard:
+  any allowed page can relay to this machine and the private network. With a token, a missing
+  or wrong one gets `401` `bad-token` (on a WebSocket, the subprotocol `peershare.<token>`),
+  which a page should report as "wrong key", not as "no Bridge running". A WebSocket must offer
+  a `peershare.` subprotocol even with no token (`peershare.` will do), or it gets `401`.
+- **Node, Bun and Deno** run `listenLoopback` unchanged: Bun and Deno serve `@hono/node-server`
+  and `ws` upgrades through their `node:http` compatibility. `pnpm test:e2e` starts the Bridge
+  under each (all three must be installed; a missing one fails with "deno is not installed").
 - `./bridge` serves with `@hono/node-server`'s `overrideGlobalObjects: false`. By default that
   server replaces the process's global `Request`/`Response`, which stalls streaming fetches
   (the mesh member's full-duplex requests) everywhere else in the process.

package/dist/bridge/bridge.d.ts

@@ -9,10 +9,14 @@
 import { type FetchHandler } from "@statewalker/webrun-http-proxy";
 import { type SocketGate } from "./sockets.js";
 export interface BridgeInit {
-    /** The Pairing token generated at launch; nothing is answered without it. */
+    /** The Pairing token; nothing is answered without it. `""`: no token is checked. */
     token: string;
-    /** The PeerShare page's origin; the only one granted cross-origin access. */
-    allowedOrigin: string;
+    /**
+     * The pages granted cross-origin access: exact origins, `scheme://host:*`
+     * (that host on any port, or none) and `*` (every site — any page the
+     * Sharer visits can then use the Bridge).
+     */
+    allowedOrigins: string[];
     /** Injected by tests; defaults to the platform's. */
     fetchImpl?: typeof fetch;
     /** Every address a `.local` name resolves to. Injected by tests; defaults to the OS resolver. */
@@ -25,6 +29,16 @@ export interface BridgeInit {
      */
     cookieJars?: boolean;
 }
+/** Whether `origin` matches one of `patterns` (see `BridgeInit.allowedOrigins`). */
+export declare function originAllowed(origin: string, patterns: string[]): boolean;
+/**
+ * Whether a request was addressed to the Bridge by a loopback name. A page
+ * whose own name was rebound to 127.0.0.1 (DNS rebinding) sends same-origin
+ * requests, so no `Origin` to refuse; only its `Host` gives it away.
+ */
+export declare function loopbackHost(host: string | null): boolean;
+/** Whether `given` is the Bridge's token; an empty token admits everyone. */
+export declare function tokenAccepted(given: string | null, token: string): boolean;
 /** Whether the Bridge may relay to `target` (rung 02 rules): `ok`, `forbidden` or `unreachable`. */
 export declare function reachable(target: string, resolveHost: (name: string) => Promise<string[]>): Promise<"ok" | "forbidden" | "unreachable">;
 export declare function systemResolve(name: string): Promise<string[]>;

package/dist/bridge/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/bridge/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,gCAAgC,CAAC;AAYxF,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,cAAc,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iGAAiG;IACjG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,oGAAoG;AACpG,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAC/C,OAAO,CAAC,IAAI,GAAG,WAAW,GAAG,aAAa,CAAC,CAO7C;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnE;AAED,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAEnE,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CA+E5D;AAsDD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../src/bridge/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,gCAAgC,CAAC;AAYxF,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,cAAc,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iGAAiG;IACjG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAezE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOzD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,oGAAoG;AACpG,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAC/C,OAAO,CAAC,IAAI,GAAG,WAAW,GAAG,aAAa,CAAC,CAO7C;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnE;AAED,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAEnE,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAkF5D;AAsDD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E"}

package/dist/bridge/bridge.js

@@ -11,6 +11,43 @@ import { MARKER, urlUpstream } from "@statewalker/webrun-http-proxy";
 import { checkTarget, isPrivateAddress } from "../targets.js";
 import { BRIDGE_COOKIES_KEPT_HEADER, BRIDGE_GUEST_HEADER, BRIDGE_MARKER, BRIDGE_REDIRECT_LOCATION_HEADER, BRIDGE_REDIRECT_STATUS_HEADER, BRIDGE_SET_COOKIE_HEADER, BRIDGE_TARGET_HEADER, BRIDGE_TOKEN_HEADER, } from "../upstreams.js";
 import { socketGate } from "./sockets.js";
+/** Whether `origin` matches one of `patterns` (see `BridgeInit.allowedOrigins`). */
+export function originAllowed(origin, patterns) {
+    return patterns.some((pattern) => {
+        if (pattern === "*" || pattern === origin)
+            return true;
+        if (!pattern.endsWith(":*"))
+            return false;
+        // Compared as parsed URLs, so `http://localhost.evil.com` is not `http://localhost`.
+        try {
+            const want = new URL(pattern.slice(0, -2));
+            const got = new URL(origin);
+            return (got.protocol === want.protocol && got.hostname === want.hostname && got.origin === origin);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Whether a request was addressed to the Bridge by a loopback name. A page
+ * whose own name was rebound to 127.0.0.1 (DNS rebinding) sends same-origin
+ * requests, so no `Origin` to refuse; only its `Host` gives it away.
+ */
+export function loopbackHost(host) {
+    if (host == null)
+        return false;
+    try {
+        return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(`http://${host}`).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether `given` is the Bridge's token; an empty token admits everyone. */
+export function tokenAccepted(given, token) {
+    return token === "" || sameSecret(given, token);
+}
 /** Whether the Bridge may relay to `target` (rung 02 rules): `ok`, `forbidden` or `unreachable`. */
 export async function reachable(target, resolveHost) {
     const verdict = checkTarget(target);
@@ -36,9 +73,12 @@ export function createBridge(init) {
         const request = jar == null ? incoming : withCookies(incoming, jar);
         // A page on another site carries its own `Origin`. No `Origin` at all is
         // a local process (curl, the Probe's CLI): the token alone admits it.
+        if (!loopbackHost(request.headers.get("host")))
+            return refuse(403, "host-forbidden");
         const origin = request.headers.get("origin");
-        if (origin != null && origin !== init.allowedOrigin)
+        if (origin != null && !originAllowed(origin, init.allowedOrigins)) {
             return refuse(403, "origin-forbidden");
+        }
         // A preflight never carries custom headers, so it cannot carry the token:
         // the origin check above is all that guards it, and it grants nothing
         // but permission to send the real, token-bearing request.
@@ -47,7 +87,7 @@ export function createBridge(init) {
             request.headers.has("access-control-request-method")) {
             return preflight(request, origin);
         }
-        if (!sameSecret(request.headers.get(BRIDGE_TOKEN_HEADER), init.token)) {
+        if (!tokenAccepted(request.headers.get(BRIDGE_TOKEN_HEADER), init.token)) {
             return refuse(401, "bad-token", origin);
         }
         // No target: the page is asking whether its Bridge is there and its

package/dist/bridge/index.d.ts

@@ -1,8 +1,8 @@
 /**
- * The Bridge (Node and Bun only): a locked-down loopback relay from the
+ * The Bridge (Node, Bun and Deno): a locked-down loopback relay from the
  * PeerShare page to the Sharer's local Services, with per-Guest cookie jars.
  */
-export { type BridgeHandler, type BridgeInit, createBridge } from "./bridge.js";
+export { type BridgeHandler, type BridgeInit, createBridge, originAllowed } from "./bridge.js";
 export { type Listening, listenLoopback } from "./serve.js";
 export { acceptedProtocol, connectApp, type InboundSocket, relaySocket, SOCKET_PATH, type SocketGate, type SocketPlan, TOKEN_PROTOCOL_PREFIX, } from "./sockets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/bridge/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bridge/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,aAAa,EAClB,WAAW,EACX,WAAW,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,qBAAqB,GACtB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bridge/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,aAAa,EAClB,WAAW,EACX,WAAW,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,qBAAqB,GACtB,MAAM,cAAc,CAAC"}

package/dist/bridge/index.js

@@ -1,7 +1,7 @@
 /**
- * The Bridge (Node and Bun only): a locked-down loopback relay from the
+ * The Bridge (Node, Bun and Deno): a locked-down loopback relay from the
  * PeerShare page to the Sharer's local Services, with per-Guest cookie jars.
  */
-export { createBridge } from "./bridge.js";
+export { createBridge, originAllowed } from "./bridge.js";
 export { listenLoopback } from "./serve.js";
 export { acceptedProtocol, connectApp, relaySocket, SOCKET_PATH, TOKEN_PROTOCOL_PREFIX, } from "./sockets.js";

package/dist/bridge/serve.d.ts

@@ -1,6 +1,6 @@
 /**
- * The Bridge on a port, under Node. Under Bun, `main.ts` hands the same
- * handler to `Bun.serve`.
+ * The Bridge on a port, under Node, Bun or Deno (the last two through their
+ * `node:http` compatibility; `tests/bridge-runtimes.e2e.test.ts`).
  */
 import type { FetchHandler } from "@statewalker/webrun-http-proxy";
 import { type SocketGate } from "./sockets.js";

package/dist/bridge/serve.js

@@ -1,6 +1,6 @@
 /**
- * The Bridge on a port, under Node. Under Bun, `main.ts` hands the same
- * handler to `Bun.serve`.
+ * The Bridge on a port, under Node, Bun or Deno (the last two through their
+ * `node:http` compatibility; `tests/bridge-runtimes.e2e.test.ts`).
  */
 import { serve } from "@hono/node-server";
 import { WebSocketServer } from "ws";

package/dist/bridge/sockets.d.ts

@@ -1,7 +1,7 @@
 /**
  * The Bridge's WebSockets (M9): `/.peershare/socket?target=<url>&protocols=a,b`.
  *
- * Guarded exactly like HTTP (rung 02): the PeerShare origin only, the
+ * Guarded exactly like HTTP (rung 02): a loopback `Host`, the allowed origins, the
  * Pairing token (as the subprotocol `peershare.<token>`, because a browser
  * cannot set headers on a WebSocket), and the same target rules. Then one
  * socket to the app is relayed message for message, both ways.
@@ -24,7 +24,7 @@ export type SocketGate = (url: URL, headers: Headers) => Promise<{
     ok: false;
     status: 400 | 401 | 403 | 502;
 }>;
-export declare function socketGate(init: Pick<BridgeInit, "token" | "allowedOrigin">, resolveHost: (name: string) => Promise<string[]>): SocketGate;
+export declare function socketGate(init: Pick<BridgeInit, "token" | "allowedOrigins">, resolveHost: (name: string) => Promise<string[]>): SocketGate;
 /** The page's side of a relayed socket, whatever server accepted it. */
 export interface InboundSocket {
     send(data: string | ArrayBuffer): void;

package/dist/bridge/sockets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sockets.d.ts","sourceRoot":"","sources":["../../src/bridge/sockets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAAC;AAE5F,wBAAgB,UAAU,CACxB,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,eAAe,CAAC,EACjD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAC/C,UAAU,CA6BZ;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAY/D;AAED,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5F;AAID,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,SAAS,GACb;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAa5F"}
+{"version":3,"file":"sockets.d.ts","sourceRoot":"","sources":["../../src/bridge/sockets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAAC;AAE5F,wBAAgB,UAAU,CACxB,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,gBAAgB,CAAC,EAClD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAC/C,UAAU,CA+BZ;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAY/D;AAED,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5F;AAID,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,SAAS,GACb;IAAE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAa5F"}

package/dist/bridge/sockets.js

@@ -1,24 +1,26 @@
 /**
  * The Bridge's WebSockets (M9): `/.peershare/socket?target=<url>&protocols=a,b`.
  *
- * Guarded exactly like HTTP (rung 02): the PeerShare origin only, the
+ * Guarded exactly like HTTP (rung 02): a loopback `Host`, the allowed origins, the
  * Pairing token (as the subprotocol `peershare.<token>`, because a browser
  * cannot set headers on a WebSocket), and the same target rules. Then one
  * socket to the app is relayed message for message, both ways.
  */
-import { reachable, sameSecret } from "./bridge.js";
+import { loopbackHost, originAllowed, reachable, tokenAccepted } from "./bridge.js";
 export const SOCKET_PATH = "/.peershare/socket";
 export const TOKEN_PROTOCOL_PREFIX = "peershare.";
 export function socketGate(init, resolveHost) {
     return async (url, headers) => {
         if (url.pathname !== SOCKET_PATH)
             return { ok: false, status: 400 };
+        if (!loopbackHost(headers.get("host")))
+            return { ok: false, status: 403 };
         const origin = headers.get("origin");
-        if (origin != null && origin !== init.allowedOrigin)
+        if (origin != null && !originAllowed(origin, init.allowedOrigins))
             return { ok: false, status: 403 };
         const offered = (headers.get("sec-websocket-protocol") ?? "").split(",").map((p) => p.trim());
         const accept = offered.find((p) => p.startsWith(TOKEN_PROTOCOL_PREFIX) &&
-            sameSecret(p.slice(TOKEN_PROTOCOL_PREFIX.length), init.token));
+            tokenAccepted(p.slice(TOKEN_PROTOCOL_PREFIX.length), init.token));
         if (accept == null)
             return { ok: false, status: 401 };
         const target = url.searchParams.get("target") ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statewalker/httpeers-share",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "description": "Share HTTP services with the members of a mesh: upstream kinds, sharing policy, probe, service table, invite links, WebSockets over the mesh, and the Bridge.",
   "bugs": {
@@ -55,6 +55,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "test": "pnpm run build && pnpm run typecheck && vitest run",
+    "test:e2e": "pnpm run build && E2E=1 vitest run tests/bridge-runtimes.e2e.test.ts",
     "typecheck": "tsc --noEmit",
     "lint": "biome check src tests",
     "lint:check": "biome check src tests"

package/src/bridge/bridge.ts

@@ -23,10 +23,14 @@ import {
 import { type SocketGate, socketGate } from "./sockets.js";
 
 export interface BridgeInit {
-  /** The Pairing token generated at launch; nothing is answered without it. */
+  /** The Pairing token; nothing is answered without it. `""`: no token is checked. */
   token: string;
-  /** The PeerShare page's origin; the only one granted cross-origin access. */
-  allowedOrigin: string;
+  /**
+   * The pages granted cross-origin access: exact origins, `scheme://host:*`
+   * (that host on any port, or none) and `*` (every site — any page the
+   * Sharer visits can then use the Bridge).
+   */
+  allowedOrigins: string[];
   /** Injected by tests; defaults to the platform's. */
   fetchImpl?: typeof fetch;
   /** Every address a `.local` name resolves to. Injected by tests; defaults to the OS resolver. */
@@ -40,6 +44,43 @@ export interface BridgeInit {
   cookieJars?: boolean;
 }
 
+/** Whether `origin` matches one of `patterns` (see `BridgeInit.allowedOrigins`). */
+export function originAllowed(origin: string, patterns: string[]): boolean {
+  return patterns.some((pattern) => {
+    if (pattern === "*" || pattern === origin) return true;
+    if (!pattern.endsWith(":*")) return false;
+    // Compared as parsed URLs, so `http://localhost.evil.com` is not `http://localhost`.
+    try {
+      const want = new URL(pattern.slice(0, -2));
+      const got = new URL(origin);
+      return (
+        got.protocol === want.protocol && got.hostname === want.hostname && got.origin === origin
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Whether a request was addressed to the Bridge by a loopback name. A page
+ * whose own name was rebound to 127.0.0.1 (DNS rebinding) sends same-origin
+ * requests, so no `Origin` to refuse; only its `Host` gives it away.
+ */
+export function loopbackHost(host: string | null): boolean {
+  if (host == null) return false;
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(`http://${host}`).hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** Whether `given` is the Bridge's token; an empty token admits everyone. */
+export function tokenAccepted(given: string | null, token: string): boolean {
+  return token === "" || sameSecret(given, token);
+}
+
 /** Whether the Bridge may relay to `target` (rung 02 rules): `ok`, `forbidden` or `unreachable`. */
 export async function reachable(
   target: string,
@@ -71,8 +112,11 @@ export function createBridge(init: BridgeInit): BridgeHandler {
     const request = jar == null ? incoming : withCookies(incoming, jar);
     // A page on another site carries its own `Origin`. No `Origin` at all is
     // a local process (curl, the Probe's CLI): the token alone admits it.
+    if (!loopbackHost(request.headers.get("host"))) return refuse(403, "host-forbidden");
     const origin = request.headers.get("origin");
-    if (origin != null && origin !== init.allowedOrigin) return refuse(403, "origin-forbidden");
+    if (origin != null && !originAllowed(origin, init.allowedOrigins)) {
+      return refuse(403, "origin-forbidden");
+    }
 
     // A preflight never carries custom headers, so it cannot carry the token:
     // the origin check above is all that guards it, and it grants nothing
@@ -84,7 +128,7 @@ export function createBridge(init: BridgeInit): BridgeHandler {
     ) {
       return preflight(request, origin);
     }
-    if (!sameSecret(request.headers.get(BRIDGE_TOKEN_HEADER), init.token)) {
+    if (!tokenAccepted(request.headers.get(BRIDGE_TOKEN_HEADER), init.token)) {
       return refuse(401, "bad-token", origin);
     }
     // No target: the page is asking whether its Bridge is there and its

package/src/bridge/index.ts

@@ -1,9 +1,9 @@
 /**
- * The Bridge (Node and Bun only): a locked-down loopback relay from the
+ * The Bridge (Node, Bun and Deno): a locked-down loopback relay from the
  * PeerShare page to the Sharer's local Services, with per-Guest cookie jars.
  */
 
-export { type BridgeHandler, type BridgeInit, createBridge } from "./bridge.js";
+export { type BridgeHandler, type BridgeInit, createBridge, originAllowed } from "./bridge.js";
 export { type Listening, listenLoopback } from "./serve.js";
 export {
   acceptedProtocol,

package/src/bridge/serve.ts

@@ -1,6 +1,6 @@
 /**
- * The Bridge on a port, under Node. Under Bun, `main.ts` hands the same
- * handler to `Bun.serve`.
+ * The Bridge on a port, under Node, Bun or Deno (the last two through their
+ * `node:http` compatibility; `tests/bridge-runtimes.e2e.test.ts`).
  */
 
 import type { IncomingMessage } from "node:http";

package/src/bridge/sockets.ts

@@ -1,14 +1,14 @@
 /**
  * The Bridge's WebSockets (M9): `/.peershare/socket?target=<url>&protocols=a,b`.
  *
- * Guarded exactly like HTTP (rung 02): the PeerShare origin only, the
+ * Guarded exactly like HTTP (rung 02): a loopback `Host`, the allowed origins, the
  * Pairing token (as the subprotocol `peershare.<token>`, because a browser
  * cannot set headers on a WebSocket), and the same target rules. Then one
  * socket to the app is relayed message for message, both ways.
  */
 
 import type { BridgeInit } from "./bridge.js";
-import { reachable, sameSecret } from "./bridge.js";
+import { loopbackHost, originAllowed, reachable, tokenAccepted } from "./bridge.js";
 
 export const SOCKET_PATH = "/.peershare/socket";
 export const TOKEN_PROTOCOL_PREFIX = "peershare.";
@@ -28,19 +28,21 @@ export type SocketGate = (
 ) => Promise<{ ok: true; plan: SocketPlan } | { ok: false; status: 400 | 401 | 403 | 502 }>;
 
 export function socketGate(
-  init: Pick<BridgeInit, "token" | "allowedOrigin">,
+  init: Pick<BridgeInit, "token" | "allowedOrigins">,
   resolveHost: (name: string) => Promise<string[]>,
 ): SocketGate {
   return async (url, headers) => {
     if (url.pathname !== SOCKET_PATH) return { ok: false, status: 400 };
+    if (!loopbackHost(headers.get("host"))) return { ok: false, status: 403 };
     const origin = headers.get("origin");
-    if (origin != null && origin !== init.allowedOrigin) return { ok: false, status: 403 };
+    if (origin != null && !originAllowed(origin, init.allowedOrigins))
+      return { ok: false, status: 403 };
 
     const offered = (headers.get("sec-websocket-protocol") ?? "").split(",").map((p) => p.trim());
     const accept = offered.find(
       (p) =>
         p.startsWith(TOKEN_PROTOCOL_PREFIX) &&
-        sameSecret(p.slice(TOKEN_PROTOCOL_PREFIX.length), init.token),
+        tokenAccepted(p.slice(TOKEN_PROTOCOL_PREFIX.length), init.token),
     );
     if (accept == null) return { ok: false, status: 401 };