cli-tunnel 1.4.0 → 1.4.2

package/dist/index.js

@@ -467,22 +467,20 @@ const wss = new WebSocketServer({
         // F-18: Session expiry
         if (Date.now() - sessionCreatedAt > SESSION_TTL)
             return false;
-        // F-3: Validate origin BEFORE ticket acceptance
-        // F-06: Require Origin header — reject non-browser clients without Origin
+        // F-3: Validate origin when present (devtunnel proxies may strip it)
         const origin = info.req.headers.origin;
-        if (!origin) {
-            return false;
-        }
-        try {
-            const originUrl = new URL(origin);
-            const host = originUrl.hostname;
-            if (host !== 'localhost' && host !== '127.0.0.1' && !host.endsWith('.devtunnels.ms')) {
+        if (origin) {
+            try {
+                const originUrl = new URL(origin);
+                const host = originUrl.hostname;
+                if (host !== 'localhost' && host !== '127.0.0.1' && !host.endsWith('.devtunnels.ms')) {
+                    return false;
+                }
+            }
+            catch {
                 return false;
             }
         }
-        catch {
-            return false;
-        }
         const url = new URL(info.req.url, `http://${info.req.headers.host}`);
         // F-02: Accept one-time ticket (only auth method for WS)
         const ticket = url.searchParams.get('ticket');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-tunnel",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Tunnel any CLI app to your phone — PTY + devtunnel + xterm.js",
   "type": "module",
   "main": "dist/index.js",

package/remote-ui/app.js

@@ -977,7 +977,7 @@
       history.replaceState(null, '', cleanUrl.toString());
     }
 
-    const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
+    var proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
 
     // If we have a ticket (from hub Connect button), use it directly
     if (ticketParam) {
@@ -985,7 +985,7 @@
     } else {
       // Exchange token for ticket
       try {
-        const resp = await fetch('/api/auth/ticket', {
+        var resp = await fetch('/api/auth/ticket', {
           method: 'POST',
           headers: { 'Authorization': 'Bearer ' + savedToken }
         });