@tivility/dsh-session-share 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -127,6 +127,22 @@ Forwarded headers are deliberately never consulted: `Host` and `X-Forwarded-*`
|
|
|
127
127
|
are attacker-controlled on any request that reaches the server, so trusting
|
|
128
128
|
them would let a visitor choose the origin the model puts in front of a user.
|
|
129
129
|
|
|
130
|
+
**`publicBaseUrl` says where links point; `trustedHosts` says who is let in.**
|
|
131
|
+
They are two halves of one deployment, and configuring either alone fails in a
|
|
132
|
+
way that reads as a bug in this package. A browser that reached a forwarded
|
|
133
|
+
origin sends `Host: dsh.example.com`, and the browser-trust fence refuses an
|
|
134
|
+
authority it was never told about — so `publicBaseUrl` on its own produces
|
|
135
|
+
links that look correct and answer `403`. Behind a proxy, set both:
|
|
136
|
+
|
|
137
|
+
```yaml
|
|
138
|
+
publicBaseUrl: https://dsh.example.com
|
|
139
|
+
trustedHosts: ['dsh.example.com']
|
|
140
|
+
```
|
|
141
|
+
|
|
142
|
+
That the fence still refuses an undeclared authority is the point, not a
|
|
143
|
+
leftover: `publicBaseUrl` changes what a link says, and is deliberately unable
|
|
144
|
+
to widen what the server answers.
|
|
145
|
+
|
|
130
146
|
With no `webServer` **and** no `publicBaseUrl`, the prompt section renders
|
|
131
147
|
nothing rather than naming a loopback address — in a headless profile that
|
|
132
148
|
would point at a server which is not running. Configure the origin of the Web
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tivility/dsh-session-share",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.2",
|
|
4
4
|
"description": "Link straight to one DeepSeek Harness session: the GUI opens on it instead of wherever it was left.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -44,7 +44,7 @@
|
|
|
44
44
|
}
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
47
|
-
"@tivility/dsh-web-kit": "^0.
|
|
47
|
+
"@tivility/dsh-web-kit": "^1.0.0"
|
|
48
48
|
},
|
|
49
49
|
"peerDependencies": {
|
|
50
50
|
"@deepseek-ai/cordis": "*",
|