administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-20 05:32:49 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

reject cross-origin go2rtc stream requests in /auth

Browse Source 
The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it.
This commit is contained in:
Josh Hawkins
2026-10-18 12:40:12 -05:00
parent 0aa7cf9de9
commit 31c3638767
6 changed files with 147 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/main/rootfs/usr/local/nginx/conf/auth_location.conf
+5
View File
@@ -19,6 +19,11 @@ location /auth {
# this cannot be spoofed
proxy_set_header X-Go2rtc-Stream-Proxy $go2rtc_stream_proxy;
proxy_set_header X-Server-Port $server_port;
# inputs for the cross-origin check on websocket and go2rtc stream requests
proxy_set_header Origin $http_origin;
proxy_set_header X-Original-Host $http_host;
proxy_set_header X-Forwarded-Host $forwarded_host;
proxy_set_header X-Original-Upgrade $http_upgrade;
proxy_set_header Content-Length "";
# Pass along auth related info
proxy_set_header Authorization $http_authorization;