hearth-dash 1.1.1 → 1.1.2

package/README.md

@@ -95,7 +95,7 @@ claude mcp add --transport http hearth-dash https://your-worker.example/mcp
 
 Then open `/mcp` inside Claude Code and complete authentication. Claude Code uses a loopback callback rather than Claude.ai's hosted callback; DCR handles its varying local port.
 
-## Upgrading from 1.0.1
+## Upgrading from 1.0.1
 
 Version 1.0.1 labelled a custom `{ "tool": ..., "params": ... }` HTTP handler as MCP. It did not implement MCP JSON-RPC or tool discovery and could not work as a Claude.ai custom connector. Version 1.1.0 replaces it with Streamable HTTP MCP and OAuth 2.1. The old payload and secret-bearing URL formats are intentionally rejected.
 
@@ -110,11 +110,15 @@ Existing deployments must:
 7. Remove and re-add the custom connector using `https://your-worker.example/mcp`.
 8. Delete the obsolete secret with `npx wrangler secret delete MCP_SECRET` after the new deployment works.
 
-The first-visit password setup page has also been removed. A public, unclaimed setup page allowed the first visitor—not necessarily the owner—to take control of a new deployment. Configure `DASHBOARD_PASSWORD` as a Worker secret instead.
-
+The first-visit password setup page has also been removed. A public, unclaimed setup page allowed the first visitor—not necessarily the owner—to take control of a new deployment. Configure `DASHBOARD_PASSWORD` as a Worker secret instead.
+
 ### 1.1.1 dashboard-login fix
 
 Version 1.1.1 keeps ordinary dashboard, login and API requests outside the OAuth provider and makes same-origin form validation resilient when a trusted Cloudflare wrapper reconstructs the internal request URL. Cross-site browser submissions remain rejected. Upgrade with `npx hearth-dash@latest deploy` if a 1.1.0 deployment returns plain `Forbidden` after submitting `/login`.
+
+### 1.1.2 Chrome null-Origin fix
+
+Version 1.1.2 accepts Chrome's legitimate `Origin: null` on a form submission only when the browser's unforgeable Fetch Metadata independently classifies the request as `same-origin`. Mismatched, malformed, same-site and cross-site requests remain rejected.
 
 ## Security notes
 

package/oauth-entry.js

@@ -1,5 +1,5 @@
 import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
-import { applicationHandler, isOAuthRoute, oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
+import { applicationHandler, isOAuthRoute, oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
 
 const OAUTH_SCOPES = ['hearth:read', 'hearth:write'];
 
@@ -34,14 +34,14 @@ function createOAuthProvider(request, env) {
   });
 }
 
-export default {
-  fetch(request, env, ctx) {
-    // Keep ordinary dashboard traffic out of the OAuth provider. Besides being
-    // unnecessary, wrapping /login and /api requests can obscure the browser's
-    // public origin on some Cloudflare routes and make valid CSRF checks fail.
-    if (!isOAuthRoute(new URL(request.url).pathname)) {
-      return applicationHandler.fetch(request, env, ctx);
-    }
-    return createOAuthProvider(request, env).fetch(request, env, ctx);
-  },
-};
+export default {
+  fetch(request, env, ctx) {
+    // Keep ordinary dashboard traffic out of the OAuth provider. Besides being
+    // unnecessary, wrapping /login and /api requests can obscure the browser's
+    // public origin on some Cloudflare routes and make valid CSRF checks fail.
+    if (!isOAuthRoute(new URL(request.url).pathname)) {
+      return applicationHandler.fetch(request, env, ctx);
+    }
+    return createOAuthProvider(request, env).fetch(request, env, ctx);
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hearth-dash",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Personal dashboard — moods, moments, food diary, weather, and more. Deploy to Cloudflare in one command.",
   "type": "module",
   "bin": {

package/worker.js

@@ -85,31 +85,51 @@ function sessionCookie(value, maxAge = 604800) {
 }
 
 export function sameOrigin(request) {
-  const origin = request.headers.get('Origin');
-  if (!origin) return true;
-  let parsedOrigin;
-  try { parsedOrigin = new URL(origin); } catch { return false; }
-  if (parsedOrigin.origin === new URL(request.url).origin) return true;
+  const targetOrigin = new URL(request.url).origin;
+  const fetchSite = request.headers.get('Sec-Fetch-Site');
+  const suppliedOrigin = classifyOrigin(request.headers.get('Origin'));
 
-  // Host and Fetch Metadata describe the browser-facing request even if a
-  // trusted Worker wrapper has reconstructed request.url with an internal
-  // origin. Browsers do not let cross-origin pages forge either value.
-  const host = request.headers.get('Host');
-  if (host && parsedOrigin.host === host) return true;
-  return request.headers.get('Sec-Fetch-Site') === 'same-origin';
+  // Fetch Metadata is browser-controlled and cannot be forged by hostile page
+  // JavaScript. Chrome can legitimately serialize Origin as "null" here, so a
+  // same-origin classification is the decisive signal for null/missing Origin.
+  if (fetchSite === 'same-origin') {
+    if (suppliedOrigin.kind === 'missing' || suppliedOrigin.kind === 'null') return true;
+    return suppliedOrigin.kind === 'origin' && suppliedOrigin.value === targetOrigin;
+  }
+
+  // Reject explicit cross-origin classifications even if another header is
+  // malformed or contradictory. "same-site" can still be another subdomain.
+  if (fetchSite === 'cross-site' || fetchSite === 'same-site' || fetchSite === 'none') return false;
+
+  // Older/non-browser clients without Fetch Metadata must provide one exact,
+  // valid HTTP(S) Origin. Unknown future Fetch Metadata values use this same
+  // conservative fallback.
+  return suppliedOrigin.kind === 'origin' && suppliedOrigin.value === targetOrigin;
 }
 
-export function isOAuthRoute(pathname) {
-  return pathname === '/mcp'
-    || pathname.startsWith('/mcp/')
-    || pathname === '/authorize'
-    || pathname === '/oauth/token'
-    || pathname === '/oauth/register'
-    || pathname === '/.well-known/oauth-authorization-server'
-    || pathname === '/.well-known/oauth-protected-resource'
-    || pathname.startsWith('/.well-known/oauth-protected-resource/');
+function classifyOrigin(value) {
+  if (value === null) return { kind: 'missing' };
+  if (value === 'null') return { kind: 'null' };
+  try {
+    const parsed = new URL(value);
+    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.origin !== value) return { kind: 'invalid' };
+    return { kind: 'origin', value: parsed.origin };
+  } catch {
+    return { kind: 'invalid' };
+  }
 }
 
+export function isOAuthRoute(pathname) {
+  return pathname === '/mcp'
+    || pathname.startsWith('/mcp/')
+    || pathname === '/authorize'
+    || pathname === '/oauth/token'
+    || pathname === '/oauth/register'
+    || pathname === '/.well-known/oauth-authorization-server'
+    || pathname === '/.well-known/oauth-protected-resource'
+    || pathname.startsWith('/.well-known/oauth-protected-resource/');
+}
+
 export async function withinRateLimit(env, request, scope, limit, windowSeconds) {
   const address = request.headers.get('CF-Connecting-IP') || 'unknown';
   const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(address)));