locadot 1.6.0-beta.2 → 1.6.0-beta.3

package/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-The version in `package.json` is 1.6.0-beta.2 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
+The version in `package.json` is 1.6.0-beta.3 (published under the `beta` tag). The owner decides the bump. **2.0.0** is suggested because of the
 breaking items below.
 
 ### Breaking
@@ -13,6 +13,7 @@ breaking items below.
 - Bare `localhost` is reserved for the dashboard and can't be mapped.
 
 ### Added
+- `--cors` per mapping (CLI, API and dashboard). `Origin`/`Referer` are sent as the target's own origin, CORS preflights are answered locally, and any origin may call the domain with credentials. (ENH-12)
 - A control panel at `https://localhost` with a dark theme. You can add, edit and remove mappings, toggle CA trust and start-at-boot, see root/admin and privileged-port status,
   tail and clear logs, and stop the proxy. (FEAT-05)
 - A token-protected JSON API for scripts and AI agents (`POST/PUT/DELETE /api/hosts`, `/api/startup`, `/api/trust`, `/api/logs`, `/api/proxy/stop`),

package/README.md

@@ -54,6 +54,7 @@ Options for `add` / `update`:
 | `-p, --port <port>` | Shorthand for `--target http://localhost:<port>`. |
 | `-t, --target <url>` | Any http(s) upstream. A bare `host:port` means `http://host:port`. |
 | `-k, --insecure` | Don't verify the TLS certificate of an `https` target (self-signed upstreams). |
+| `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. URLs hard-coded in pages still go to the real domain. |
 | `--no-start` | Save the mapping without starting the proxy. |
 
 ### Proxy
@@ -93,7 +94,7 @@ are answered by locadot itself, not proxied. The page is a dark control panel:
 
 - **System:** whether the proxy runs as root/admin, whether ports below 1024 can be bound (with the Linux sysctl fix when they
   can't), CA trust with an on/off toggle, start-at-boot with an on/off toggle, ports, bind addresses and state dir. It also has a **Stop proxy** button.
-- **Proxies:** add a mapping (host + port / host:port / URL, and an optional "insecure TLS" box), edit a target inline, or remove one. The table shows
+- **Proxies:** add a mapping (host + port / host:port / URL, and optional "Insecure TLS" and "Bypass CORS" boxes), edit a target inline, or remove one. The table shows
   each source → destination with up/down, status, latency, hits, errors, last access and average ms. It refreshes every 5 s.
 - **Logs:** a live tail with refresh and clear.
 - **CLI / API snippets** you can copy.
@@ -113,8 +114,8 @@ each time the proxy starts.
 | `GET /api/status` | | Proxy info, uptime, host count, and `system` (`platform`, `isRoot`, `canBindPrivileged`, `unprivilegedPortStart`, `caTrusted`, `startup`, `stateDir`). |
 | `GET /api/hosts` | | Every mapping with urls, probe (`up`, `status`, `ms`) and stats. |
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
-| `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false }` | Add a mapping (201; 409 if it exists). |
-| `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false }` | Change a mapping (404 if unknown). |
+| `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
+| `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
 | `DELETE /api/hosts/:host` | | Remove a mapping. |
 | `POST /api/startup` | `{ "enabled": true }` | Start at boot on/off. |
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |

package/dist/dashboard/api.js

@@ -165,7 +165,7 @@ async function route(req, url, ctx) {
     const body = await readJson(req);
     try {
         if (path === "/api/hosts") {
-            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure") });
+            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
             return { status: 201, body: { ok: true, host, ...entry, url: hostUrl(host, ctx) } };
@@ -178,7 +178,7 @@ async function route(req, url, ctx) {
                 logger_1.default.info(`🗑️ dashboard: removed ${host}`);
                 return { status: 200, body: { ok: true, host } };
             }
-            const updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure") });
+            const updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
             ctx.reload();
             logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             return { status: 200, body: { ok: true, host: updated.host, ...updated.entry, url: hostUrl(updated.host, ctx) } };

package/dist/dashboard/index.js

@@ -42,6 +42,7 @@ async function buildHosts(ctx) {
             host,
             target: entry.target,
             insecure: !!entry.insecure,
+            cors: !!entry.cors,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),

package/dist/dashboard/page.js

@@ -305,6 +305,9 @@ tr:last-child td { border-bottom: none; }
   width: 100%;
   min-width: 160px;
 }
+.badges { display: flex; flex-wrap: wrap; gap: 4px; }
+.badge-cors { color: var(--accent-cyan); border-color: var(--accent-cyan); background: rgba(34, 211, 238, 0.1); }
+td .inline-check + .inline-check { margin-top: 4px; }
 .inline-check { display: flex; align-items: center; gap: 6px; font-size: 12px; color: var(--muted); }
 .dim { color: var(--muted-dim); }
 
@@ -449,6 +452,7 @@ const clientJs = `
   var addHostInput = document.getElementById("add-host");
   var addTargetInput = document.getElementById("add-target");
   var addInsecureInput = document.getElementById("add-insecure");
+  var addCorsInput = document.getElementById("add-cors");
   var addSubmitBtn = document.getElementById("add-submit");
   var addErrorEl = document.getElementById("add-error");
 
@@ -757,9 +761,10 @@ const clientJs = `
     }
     if (hostVal.indexOf(".") === -1) hostVal = hostVal + ".localhost";
     var insecureVal = !!addInsecureInput.checked;
+    var corsVal = !!addCorsInput.checked;
     addSubmitBtn.disabled = true;
     addSubmitBtn.classList.add("busy");
-    apiFetch("/api/hosts", { method: "POST", body: JSON.stringify({ host: hostVal, target: targetVal, insecure: insecureVal }) })
+    apiFetch("/api/hosts", { method: "POST", body: JSON.stringify({ host: hostVal, target: targetVal, insecure: insecureVal, cors: corsVal }) })
       .then(function () {
         addForm.reset();
         showToast("Added " + hostVal, "success");
@@ -822,17 +827,24 @@ const clientJs = `
     tr.appendChild(makeCell("\\u2192", "arrow"));
     tr.appendChild(makeCell(row.target, "mono"));
 
-    var insecureTd = document.createElement("td");
-    if (row.insecure) {
-      var badge = document.createElement("span");
-      badge.className = "badge";
-      badge.textContent = "insecure";
-      insecureTd.appendChild(badge);
+    var optionsTd = document.createElement("td");
+    var flags = [];
+    if (row.insecure) flags.push(["insecure", "Upstream TLS certificate is not verified"]);
+    if (row.cors) flags.push(["cors", "Origin/Referer rewritten to the target; any origin may call this host"]);
+    if (flags.length) {
+      optionsTd.className = "badges";
+      flags.forEach(function (flag) {
+        var badge = document.createElement("span");
+        badge.className = "badge" + (flag[0] === "cors" ? " badge-cors" : "");
+        badge.textContent = flag[0];
+        badge.title = flag[1];
+        optionsTd.appendChild(badge);
+      });
     } else {
-      insecureTd.className = "dim";
-      insecureTd.textContent = "\\u2014";
+      optionsTd.className = "dim";
+      optionsTd.textContent = "\\u2014";
     }
-    tr.appendChild(insecureTd);
+    tr.appendChild(optionsTd);
 
     var statusTd = document.createElement("td");
     statusTd.appendChild(statusPill(row));
@@ -899,6 +911,14 @@ const clientJs = `
     insecureLabel.appendChild(insecureInput);
     insecureLabel.appendChild(document.createTextNode("insecure"));
     insecureTd.appendChild(insecureLabel);
+    var corsLabel = document.createElement("label");
+    corsLabel.className = "inline-check";
+    var corsInput = document.createElement("input");
+    corsInput.type = "checkbox";
+    corsInput.checked = !!row.cors;
+    corsLabel.appendChild(corsInput);
+    corsLabel.appendChild(document.createTextNode("cors"));
+    insecureTd.appendChild(corsLabel);
     tr.appendChild(insecureTd);
 
     tr.appendChild(makeCell("\\u2014", "dim"));
@@ -927,7 +947,7 @@ const clientJs = `
       cancelBtn.disabled = true;
       apiFetch("/api/hosts/" + encodeURIComponent(row.host), {
         method: "PUT",
-        body: JSON.stringify({ target: newTarget, insecure: !!insecureInput.checked })
+        body: JSON.stringify({ target: newTarget, insecure: !!insecureInput.checked, cors: !!corsInput.checked })
       })
         .then(function () {
           editingHost = null;
@@ -1134,6 +1154,10 @@ function renderPage(nonce, token) {
           <input type="checkbox" id="add-insecure" name="insecure">
           <label for="add-insecure">Insecure TLS</label>
         </div>
+        <div class="field field-checkbox" title="Send Origin/Referer as the target's own and let any origin call this host">
+          <input type="checkbox" id="add-cors" name="cors">
+          <label for="add-cors">Bypass CORS</label>
+        </div>
         <button type="submit" id="add-submit" class="btn btn-primary">Add proxy</button>
       </div>
       <div id="add-error" class="field-error" role="alert" hidden></div>
@@ -1153,7 +1177,7 @@ function renderPage(nonce, token) {
             <th scope="col">Host</th>
             <th scope="col" class="visually-hidden">Flow</th>
             <th scope="col">Target</th>
-            <th scope="col">Insecure</th>
+            <th scope="col">Options</th>
             <th scope="col">Status</th>
             <th scope="col">Hits</th>
             <th scope="col">Errors</th>

package/dist/index.js

@@ -30,6 +30,8 @@ const destinationOptions = (command) => command
     .option("-p, --port <port>", "Local port to forward to (shorthand for --target http://localhost:<port>)")
     .option("-t, --target <url>", "Any upstream: 3000, 127.0.0.1:8080, http://192.168.1.5:8080, https://google.com")
     .option("-k, --insecure", "Don't verify the TLS certificate of an https target")
+    .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
+    .option("--no-cors", "Turn --cors off again (update)")
     .option("--no-start", "Only save the mapping; don't start the proxy");
 program
     .name("locadot")

package/dist/lib/commands.js

@@ -90,7 +90,7 @@ const warnIfDown = async (entry) => {
 };
 class Commands {
     static async add(options) {
-        const { host, entry } = await hosts_1.default.add({ host: options.host, target: resolveTarget(options), insecure: options.insecure });
+        const { host, entry } = await hosts_1.default.add({ host: options.host, target: resolveTarget(options), insecure: options.insecure, cors: options.cors });
         const { target } = entry;
         await ensureRunning(options);
         print(`✅ ${(0, exports.urlFor)(host)} → ${target}`);
@@ -100,7 +100,7 @@ class Commands {
         await warnIfDown(entry);
     }
     static async update(options) {
-        const { host, entry } = await hosts_1.default.update({ host: options.host, target: resolveTarget(options), insecure: options.insecure });
+        const { host, entry } = await hosts_1.default.update({ host: options.host, target: resolveTarget(options), insecure: options.insecure, cors: options.cors });
         const { target } = entry;
         await ensureRunning(options);
         print(`✅ Updated ${(0, exports.urlFor)(host)} → ${target}`);
@@ -122,7 +122,7 @@ class Commands {
         }
         const width = Math.max(...hosts.map(([host]) => (0, exports.urlFor)(host).length));
         for (const [host, entry] of hosts) {
-            print(`${(0, exports.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}`);
+            print(`${(0, exports.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}`);
         }
         print(`☑️ Total: ${hosts.length}.`);
     }

package/dist/lib/hosts.js

@@ -69,7 +69,7 @@ class HostOps {
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -82,7 +82,8 @@ class HostOps {
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             const insecure = input.insecure ?? existing.insecure;
-            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, updatedAt: new Date().toISOString() };
+            const cors = input.cors ?? existing.cors;
+            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, cors: cors || undefined, updatedAt: new Date().toISOString() };
             return registry.hosts[host];
         });
         return { host, entry };

package/dist/lib/http.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hostOf = void 0;
+exports.applyCors = exports.hostOf = void 0;
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
@@ -34,8 +34,54 @@ const proxyOptions = (req, entry) => ({
     hostRewrite: req.headers.host,
     protocolRewrite: isTls(req) ? "https" : "http",
     cookieDomainRewrite: { "*": "" },
-    headers: { "X-Original-Host": req.headers.host || "" },
+    headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? sameOriginHeaders(req, entry) : {}) },
 });
+// --cors: the upstream should see a request from its own site, so origin/CSRF checks pass.
+const sameOriginHeaders = (req, entry) => {
+    const origin = new URL(entry.target).origin;
+    const headers = {};
+    if (req.headers.origin)
+        headers.Origin = origin;
+    if (req.headers.referer) {
+        try {
+            const referer = new URL(req.headers.referer);
+            headers.Referer = origin + referer.pathname + referer.search;
+        }
+        catch {
+            headers.Referer = origin + "/";
+        }
+    }
+    return headers;
+};
+const isPreflight = (req) => req.method === "OPTIONS" && !!req.headers.origin && !!req.headers["access-control-request-method"];
+/** Headers that let the calling page read the response, credentials included. */
+const allowOrigin = (req) => req.headers.origin
+    ? { "Access-Control-Allow-Origin": req.headers.origin, "Access-Control-Allow-Credentials": "true", Vary: "Origin" }
+    : { "Access-Control-Allow-Origin": "*" };
+/**
+ * Rewrites an upstream response for a --cors host: our CORS headers replace the upstream's,
+ * and cookies become SameSite=None so a page on another origin can send them back.
+ */
+const applyCors = (req, headers) => {
+    for (const name of Object.keys(headers)) {
+        if (name.startsWith("access-control-"))
+            delete headers[name];
+    }
+    const exposed = Object.keys(headers).filter((name) => name !== "set-cookie" && name !== "vary");
+    headers["access-control-allow-origin"] = req.headers.origin || "*";
+    if (req.headers.origin) {
+        headers["access-control-allow-credentials"] = "true";
+        const vary = String(headers.vary || "");
+        if (!/(^|,)\s*(origin|\*)\s*(,|$)/i.test(vary))
+            headers.vary = vary ? `${vary}, Origin` : "Origin";
+    }
+    if (exposed.length)
+        headers["access-control-expose-headers"] = exposed.join(", ");
+    if (isTls(req) && headers["set-cookie"]) {
+        headers["set-cookie"] = headers["set-cookie"].map((cookie) => cookie.replace(/;\s*samesite=[^;]*/gi, "").replace(/;\s*secure\b(?!=)/gi, "") + "; SameSite=None; Secure");
+    }
+};
+exports.applyCors = applyCors;
 const record = (stats, host, status, ms, error) => {
     const current = stats.get(host) || { hits: 0, errors: 0 };
     current.hits += 1;
@@ -60,6 +106,20 @@ class HttpModule {
                 res.end((0, template_1.proxyNotFound)(host, dashboardUrl(req)));
                 return;
             }
+            // Answered here: upstreams often reject OPTIONS or don't send the headers the browser wants.
+            if (entry.cors && isPreflight(req)) {
+                const requested = req.headers["access-control-request-headers"];
+                res.writeHead(204, {
+                    ...allowOrigin(req),
+                    "Access-Control-Allow-Methods": String(req.headers["access-control-request-method"]),
+                    ...(requested ? { "Access-Control-Allow-Headers": String(requested) } : {}),
+                    ...(req.headers["access-control-request-private-network"] ? { "Access-Control-Allow-Private-Network": "true" } : {}),
+                    "Access-Control-Max-Age": "600",
+                    "Content-Length": "0",
+                });
+                res.end();
+                return;
+            }
             const started = Date.now();
             res.once("finish", () => {
                 record(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500);
@@ -70,7 +130,8 @@ class HttpModule {
                     res.destroy();
                     return;
                 }
-                res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+                // With --cors the page should see a 502, not a CORS error.
+                res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", ...(entry.cors ? allowOrigin(req) : {}) });
                 res.end((0, template_1.upstreamDown)(host, entry.target, err?.code || err?.message || "error", dashboardUrl(req)));
             });
         }

package/dist/server.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -12,7 +45,7 @@ const http_proxy_1 = __importDefault(require("http-proxy"));
 const constants_1 = __importDefault(require("./constants"));
 const registry_1 = __importDefault(require("./lib/registry"));
 const locadot_file_1 = __importDefault(require("./lib/locadot-file"));
-const http_2 = __importDefault(require("./lib/http"));
+const http_2 = __importStar(require("./lib/http"));
 const localhost_1 = __importDefault(require("./lib/localhost"));
 const file_1 = __importDefault(require("./utils/file"));
 const logger_1 = __importDefault(require("./utils/logger"));
@@ -68,7 +101,7 @@ async function startCentralProxy() {
     // Hop-by-hop headers describe the upstream connection, not ours. Apache sends
     // `Connection: Upgrade, close` + `Upgrade: h2`, which made us close the browser's
     // socket after every response (ERR_TOO_MANY_RETRIES on asset-heavy pages).
-    proxy.on("proxyRes", (proxyRes) => {
+    proxy.on("proxyRes", (proxyRes, req) => {
         if (proxyRes.statusCode === 101)
             return;
         const listed = String(proxyRes.headers.connection || "")
@@ -78,6 +111,8 @@ async function startCentralProxy() {
         for (const name of [...listed, "connection", "keep-alive", "upgrade", "proxy-connection"]) {
             delete proxyRes.headers[name];
         }
+        if (registry.hosts[(0, http_2.hostOf)(req)]?.cors)
+            (0, http_2.applyCors)(req, proxyRes.headers);
     });
     const info = {
         pid: process.pid,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "1.6.0-beta.2",
+  "version": "1.6.0-beta.3",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",