locadot 2.1.0-beta.3 → 2.1.0-beta.4

package/CHANGELOG.md

@@ -33,6 +33,10 @@
   Senders must run this version too; an older sender answers `<domain>.localhost` with a 404.
 
 ### Fixed
+- `--cors` pages that call an API on a bare `localhost:<port>` (e.g. `VITE_SERVER_URL=http://localhost:3100`) now send those
+  calls through the page's own origin (`/__locadot/x/http/localhost:3100/…`) like any other cross-origin call. Opened through
+  remote access, the API used to be called on the *viewer's* localhost, where it doesn't exist. A peer's pass-through reaches
+  the sender's localhost only with localhost access (admin, `hub:localhost on`), and never the proxy's own ports.
 - The proxy can now tell a user's `LOCADOT_HTTP_PORT`/`LOCADOT_HTTPS_PORT` from the copies the CLI pins on every spawn
   (`LOCADOT_USER_PORTS`), so saved ports aren't reported as env-overridden.
 - `--cors` through remote access: a shared `--cors` mapping is now `--cors` on the receiver too (shown in `list` and the

package/README.md

@@ -295,6 +295,8 @@ locadot add --host signalsant.localhost --target https://signalsant.com --cors
   `XMLHttpRequest`, `EventSource`, `WebSocket` and `sendBeacon` calls to other origins through the page's own origin
   (`/__locadot/x/https/api.signalsant.com/…`). The browser sees a same-origin request, so CORS never applies, and locadot
   forwards it with `Origin: https://signalsant.com`. Only the page itself can use it: requests from other sites get a 403.
+  Calls to a bare `localhost:<port>` (an API or dev server next to the app) go the same way, so the page works when opened
+  from another machine through remote access too. There, only admin peers reach the sender's localhost this way.
 - **Cookies.** The page's cookies are forwarded only to the same site (`api.signalsant.com`), never to third parties.
   Cookies set by third parties are dropped.
 - **Mapped domains.** If you also map a domain (`api.signalsant.localhost` → `https://api.signalsant.com --cors`), its URLs in

package/dist/proxy/guard.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicOnlyAgents = exports.isPublicHost = exports.isPublicAddress = void 0;
+exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
 const dns_1 = __importDefault(require("dns"));
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
@@ -54,6 +54,17 @@ const isPublicAddress = (address) => {
     return net_1.default.isIPv6(address) && !blocked.check(address, "ipv6");
 };
 exports.isPublicAddress = isPublicAddress;
+/** localhost, *.localhost, 127.0.0.0/8, ::1 or 0.0.0.0: this machine itself. */
+const isLoopbackHost = (host) => {
+    const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
+    if (name === "localhost" || name.endsWith(".localhost"))
+        return true;
+    const v4 = net_1.default.isIPv4(name) ? name : net_1.default.isIPv6(name) ? embeddedV4(name) : undefined;
+    if (v4)
+        return v4.startsWith("127.") || v4 === "0.0.0.0";
+    return name === "::1" || name === "::";
+};
+exports.isLoopbackHost = isLoopbackHost;
 /** A host the pass-through may call for a tunnel visitor, judged before any DNS lookup. */
 const isPublicHost = (host) => {
     const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();

package/dist/proxy/hub.js

@@ -180,7 +180,7 @@ function classify(req, publicHost, hosts, opts) {
         if (host && names && self && scheme)
             names[host] = `${scheme}://${self}`;
         stripLocadotHeaders(req);
-        return { kind: "local", port, peer, names, host };
+        return { kind: "local", port, peer, names, host, loopback: opts?.blockedPorts ?? [] };
     }
     const hostHeader = req.headers["x-locadot-host"];
     const host = typeof hostHeader === "string" ? hostHeader.trim().toLowerCase() : "";
@@ -194,7 +194,9 @@ function classify(req, publicHost, hosts, opts) {
     }
     const names = req.headers["x-locadot-names"] === undefined ? undefined : peerNames(req, visible);
     stripLocadotHeaders(req);
-    return { kind: "app", host, peer, names };
+    // A --cors page's pass-through calls to localhost:<port> reach this machine only for peers allowed its localhost.
+    const loopback = links_1.default.can(peer, "localhost") && opts?.localhost !== false ? opts?.blockedPorts ?? [] : undefined;
+    return { kind: "app", host, peer, names, loopback };
 }
 /* ---------- /_locadot/v1 API ---------- */
 const send = (res, status, body) => {

package/dist/proxy/passthrough.js

@@ -56,12 +56,16 @@ exports.shimScript = `(() => {
   if (window.__locadotShim) return;
   window.__locadotShim = true;
   const VIA = ${JSON.stringify(VIA)};
+  const portOf = (url) => url.port || (url.protocol === "https:" || url.protocol === "wss:" ? "443" : "80");
   const route = (input) => {
     try {
       const url = new URL(String(input), location.href);
       if (!/^(https?|wss?):$/.test(url.protocol)) return null;
-      const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-      if (local || url.host === location.host) return null;
+      if (url.hostname.endsWith(".localhost") || url.host === location.host) return null;
+      // Bare localhost:<port> (an app's API or dev server) exists only where the app runs, so it goes through the
+      // page's origin too; a remote viewer's own localhost doesn't have it. The page's own proxy port stays direct.
+      const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+      if (loopback && portOf(url) === portOf(location)) return null;
       const ws = url.protocol === "ws:" || url.protocol === "wss:";
       const base = ws ? (location.protocol === "https:" ? "wss://" : "ws://") + location.host : location.origin;
       return base + VIA + url.protocol.slice(0, -1) + "/" + url.host + url.pathname + url.search + url.hash;
@@ -150,7 +154,7 @@ const rewriteViaResponse = (headers, via, target) => {
         else {
             try {
                 const url = new URL(location, `${via.scheme}://${via.host}/`);
-                if (/^https?:$/.test(url.protocol) && !/(^|\.)localhost$/.test(url.hostname))
+                if (/^https?:$/.test(url.protocol) && !url.hostname.endsWith(".localhost"))
                     headers.location = (0, exports.viaPath)(url) + url.hash;
             }
             catch { }

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.loopbackOf = exports.peerNamesOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -25,6 +25,8 @@ const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
 exports.peerOriginOf = peerOriginOf;
 const peerNamesOf = (req) => tags.get(req)?.peerNames;
 exports.peerNamesOf = peerNamesOf;
+const loopbackOf = (req) => tags.get(req)?.loopback;
+exports.loopbackOf = loopbackOf;
 const viaOf = (req) => tags.get(req)?.via;
 exports.viaOf = viaOf;
 /** Tunnel visitors are on https even though cloudflared talks plain http to us. */

package/dist/proxy/router.js

@@ -20,7 +20,7 @@ const stats_1 = require("./stats");
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
 const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "app") {
-        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names });
+        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return hub.host;
     }
     if (hub?.kind === "dashboard") {
@@ -30,7 +30,7 @@ const resolveHost = (req, ctx, hub) => {
     if (hub?.kind === "local") {
         // A port behind a --cors mapping is served as that mapping, cors included.
         const host = hub.host ?? `localhost:${hub.port}`;
-        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names });
+        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure(), peerNames: hub.names, loopback: hub.loopback });
         return host;
     }
     const host = (0, request_1.hostOf)(req);
@@ -41,8 +41,16 @@ const resolveHost = (req, ctx, hub) => {
 };
 const dashboardUrl = (req) => `${(0, urls_1.urlFor)("localhost", (0, request_1.isTls)(req))}/`;
 const passThrough = (req, entry) => Boolean(entry.cors);
-/** Same-origin only, and a tunnel visitor may only reach public hosts (see guard.ts). */
-const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host));
+/** A hub peer reaches this machine's localhost:<port> only with localhost access, and never the proxy's own ports. */
+const peerMayReach = (req, via) => {
+    if (!(0, request_1.fromRemote)(req) || !(0, guard_1.isLoopbackHost)(via.host))
+        return true;
+    const allowed = (0, request_1.loopbackOf)(req);
+    const port = Number(via.host.match(/:(\d+)$/)?.[1] || (via.scheme === "https" || via.scheme === "wss" ? 443 : 80));
+    return Boolean(allowed && !allowed.includes(port));
+};
+/** Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost. */
+const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via);
 /**
  * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
  * its apps' origins to the names this machine uses rather than its own.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.1.0-beta.3",
+  "version": "2.1.0-beta.4",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",