artifacty 0.10.3 → 0.10.4

package/docs/network-sharing.md

@@ -44,9 +44,9 @@ When Artifacty binds outside loopback, startup output includes a warning that th
 
 ## Browser Write Behavior
 
-Remote browsers can read shared pages, but write actions are intentionally conservative. Mutating browser routes reject non-local `Origin` headers to reduce CSRF risk. For LAN sharing, prefer API or MCP writes with an explicit token header.
+Remote browsers can read shared pages and can submit browser forms when the request is same-origin with the Artifacty host, for example `Origin: http://10.0.0.50:8787` with `Host: 10.0.0.50:8787`. Mutating browser routes reject cross-origin requests to reduce CSRF risk. For scripts and agents, prefer API or MCP writes with an explicit token header.
 
-Do not relax the origin check just to make remote browser writes easier. A future team dashboard should use a dedicated policy that combines same-origin remote requests, explicit token validation, and clear operator intent.
+Do not disable the origin check just to make remote browser writes easier. Same-origin central dashboard writes should pass; writes initiated from another website should fail with `NON_LOCAL_ORIGIN`.
 
 ## Renderer Guidance
 

package/docs/threat-model.md

@@ -68,9 +68,10 @@ reachable from the user's browser.
 
 Controls:
 
-- Mutating browser routes reject non-local `Origin` headers.
+- Mutating browser routes allow loopback or same-origin requests and reject
+  cross-origin writes.
 - API routes require a token when configured.
-- LAN/team mode does not relax browser-origin checks.
+- LAN/team mode does not allow arbitrary browser origins.
 
 ### Untrusted Artifact Rendering
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.3",
+  "version": "0.10.4",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/server.js

@@ -816,11 +816,25 @@ export function assertLocalOrigin(request) {
     return;
   }
 
-  const parsed = new URL(origin);
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    throw Object.assign(new Error(`Rejected invalid origin: ${origin}`), {
+      statusCode: 403,
+      code: "NON_LOCAL_ORIGIN"
+    });
+  }
+
   const hostname = parsed.hostname.toLowerCase();
-  const allowed = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  const host = String(request.headers.host || "").toLowerCase();
+  const allowed =
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    (host && parsed.host.toLowerCase() === host && (parsed.protocol === "http:" || parsed.protocol === "https:"));
   if (!allowed) {
-    throw Object.assign(new Error(`Rejected non-local origin: ${origin}`), {
+    throw Object.assign(new Error(`Rejected untrusted origin: ${origin}`), {
       statusCode: 403,
       code: "NON_LOCAL_ORIGIN"
     });