@ti-engine/web-framework 1.15.0 → 1.16.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 This document will contain the list of changes made to the framework. The format is based on the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.
 
+## Version 1.16.0
+
+Support explicitly trusted request origins so state-changing requests (e.g. login) work behind proxies that do not present the app's external host — most notably GitHub Codespaces port forwarding (CA-90).
+
+* feat(web-framework): add `TI_WEB_TRUSTED_ORIGINS` (comma-separated) / `config.trustedOrigins`. The `originRefererValidationHandler` now accepts a non-GET request whose `Origin`/`Referer` matches the server-reconstructed base URL **or** any configured trusted origin. Previously such a request behind a proxy that rewrote/omitted the forwarded host was rejected with `E_WEB_INVALID_REQUEST_PARAMETERS` (HTTP 403). Backward compatible (empty list = prior behavior); the CSRF double-submit token check is unchanged and still enforced
+* build(release): bump package version from `1.15.0` to `1.16.0`
+
 ## Version 1.15.0
 
 A dedicated health endpoint, a `TI_WEB_AUTH_METHODS` env override, and login-page gating for every auth method — completing the container-friendly auth/health story for the competence deployment (CA-90).

package/bin/web-server.js

@@ -301,7 +301,7 @@ class TiWebServer extends ServiceConsumer {
                     store: new SessionStore()
                 } ) );
                 this.#webServer.use( webHandlers.csrfInitHandler( this ) );
-                this.#webServer.use( webHandlers.originRefererValidationHandler() );
+                this.#webServer.use( webHandlers.originRefererValidationHandler( this ) );
                 this.#webServer.use( webHandlers.csrfProtectionHandler() );
 
                 // Set up the web server routes:

package/components/web-config-env.js

@@ -14,9 +14,10 @@ const tools = require( "@ti-engine/core/tools" );
  * Applies TI_WEB_* environment-variable overrides onto an (already-merged) web server configuration object.
  * Each override is applied ONLY when its environment variable is defined, so an absent variable leaves the
  * configured/default value untouched (fully backward compatible). This gives ti-engine web servers 12-factor,
- * container-friendly control over network binding, TLS, the session cookie secret, and the enabled authentication
- * methods without editing config files. Note `TI_WEB_AUTH_METHODS` fully REPLACES `auth.enabledMethods` (a clean
- * array replacement) rather than merging — the config-file merge is by-index and cannot cleanly override an array.
+ * container-friendly control over network binding, TLS, the session cookie secret, the enabled authentication
+ * methods, and the trusted request origins without editing config files. Note `TI_WEB_AUTH_METHODS` and
+ * `TI_WEB_TRUSTED_ORIGINS` fully REPLACE their config arrays (`auth.enabledMethods` / `trustedOrigins`) rather than
+ * merging — the config-file merge is by-index and cannot cleanly override an array.
  *
  * @method
  * @param {Object} config The web server configuration to augment (mutated in place and returned).
@@ -54,6 +55,9 @@ function applyWebConfigEnvOverrides( config, env = process.env ) {
         config.auth = config.auth || {};
         config.auth.enabledMethods = env.TI_WEB_AUTH_METHODS.split( "," ).map( ( method ) => method.trim() ).filter( ( method ) => method.length > 0 );
     }
+    if ( env.TI_WEB_TRUSTED_ORIGINS !== undefined ) {
+        config.trustedOrigins = env.TI_WEB_TRUSTED_ORIGINS.split( "," ).map( ( origin ) => origin.trim() ).filter( ( origin ) => origin.length > 0 );
+    }
     return config;
 }
 

package/components/web-handlers.js

@@ -690,19 +690,30 @@ module.exports.webAppHandler = ( instance ) => {
  * @returns {ExpressHandler}
  * @public
  */
-module.exports.originRefererValidationHandler = () => {
+module.exports.originRefererValidationHandler = ( instance ) => {
     return ( request, response, next ) => {
         if ( request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS" ) {
             next();
         } else {
-            const expectedOrigin = getBaseUrl( request );
             const providedOrigin = getRequestOrigin( request );
-            // If the browser didn’t send Origin/Referer (normal for same-origin form POSTs), let CSRF middleware handle protection instead of blocking here:
-            if ( providedOrigin && String( providedOrigin ).trim().toLowerCase() !== String( expectedOrigin ).trim().toLowerCase() ) {
-                logger.log( `Issue identified with origin/referer mismatch. Expected '${ expectedOrigin }', received '${ providedOrigin }'.`, logger.logSeverity.WARNING );
-                next( exceptions.raise( exceptions.exceptionCode.E_WEB_INVALID_REQUEST_PARAMETERS, null, exceptions.httpCode.C_403 ) );
-            } else {
+            // If the browser didn't send Origin/Referer (normal for same-origin form POSTs), let CSRF middleware handle protection instead of blocking here:
+            if ( !providedOrigin ) {
                 next();
+            } else {
+                // Accept the origin the server reconstructs from the request, plus any explicitly trusted origins
+                // (TI_WEB_TRUSTED_ORIGINS / config.trustedOrigins). The trusted list is needed behind proxies that do
+                // not present the external host to the app (e.g. GitHub Codespaces port forwarding), where the browser
+                // Origin cannot be reconstructed from the forwarded headers.
+                const configured = ( instance && instance.serviceConfig && Array.isArray( instance.serviceConfig.trustedOrigins ) ) ? instance.serviceConfig.trustedOrigins : [];
+                const allowedOrigins = [ getBaseUrl( request ) ].concat( configured );
+                const normalizedProvided = String( providedOrigin ).trim().toLowerCase();
+                const isAllowed = allowedOrigins.some( ( origin ) => String( origin ).trim().toLowerCase() === normalizedProvided );
+                if ( isAllowed ) {
+                    next();
+                } else {
+                    logger.log( `Issue identified with origin/referer mismatch. Received '${ providedOrigin }'; expected one of [ ${ allowedOrigins.join( ", " ) } ].`, logger.logSeverity.WARNING );
+                    next( exceptions.raise( exceptions.exceptionCode.E_WEB_INVALID_REQUEST_PARAMETERS, null, exceptions.httpCode.C_403 ) );
+                }
             }
         }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ti-engine/web-framework",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "A web-framework based on the ti-engine. It provides a customizable ready-to-use web-server microservice and a set of tools for creating web applications. NOTICE: This is still a work in progress and the full architecture, design, and functionality are not available!",
   "author": "Boris Kostadinov <kostadinov.boris@gmail.com>",
   "license": "GPL-3.0-or-later",