Reject cross-origin websocket connections (#24714)

* reject cross-origin websocket handshakes

Neither /ws nor the jsmpeg websockets checked Origin, and the internal port grants admin to everyone, so any page a LAN user visited could open ws://frigate:5000/ws and send commands or read streams. Both servers now reject a browser handshake whose Origin host matches neither Host nor X-Forwarded-Host, and allow handshakes without an Origin for non-browser clients. nginx now forwards an outer proxy's X-Forwarded-Host instead of overwriting it, so proxies that rewrite Host and the Home Assistant integration's proxy still match.

* apply runtime role changes to jsmpeg streams

The output process never subscribed to config/auth, so role edits from the Roles UI (requires_restart 0) did not reach it and jsmpeg kept streaming cameras that had been removed from a role until restart. The output process now replaces its auth config on config/auth updates, which the camera and birdseye broadcast threads read through the shared config.

* tidy origin check docstring and auth update comment

* reject cross-origin go2rtc stream requests in /auth

The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it.

* set Host in the nginx proxy doc examples

* drain all queued auth updates in the output process

* note that cards must stream through the integration proxy

* strip the query before matching go2rtc paths in the origin check

docs/docs/configuration/advanced/system.md

@@ -360,6 +360,7 @@ For example, in Nginx:
 
 ```
 location /frigate {
+    proxy_set_header Host $host;
     proxy_set_header X-Ingress-Path /frigate;
     proxy_pass http://frigate_backend;
 }

docs/docs/guides/reverse_proxy.md

@@ -37,6 +37,8 @@ Your reverse proxy must be configured to forward the `Upgrade` and `Connection`
 
 Note that some proxies disable WebSocket support by default. For example, Nginx Proxy Manager has a "Websockets Support" toggle that must be enabled.
 
+Frigate rejects WebSocket connections opened from a page on another site. Your proxy must either preserve the original `Host` header or send it in `X-Forwarded-Host`, otherwise Frigate cannot tell the connection came from its own UI.
+
 ## Proxies
 
 There are many solutions available to implement reverse proxies and the community is invited to help out documenting others through a contribution to this page.
@@ -161,6 +163,7 @@ The settings below enabled connection upgrade, sets up logging (optional) and pr
   error_log /data/logs/proxy-host-40_error.log warn;
 
   location / {
+    proxy_set_header Host $host;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $http_connection;
     proxy_http_version 1.1;

docs/docs/integrations/home-assistant.md

@@ -55,6 +55,10 @@ To install the optional companion Lovelace card, please see the [separate
 installation instructions](https://github.com/dermotduffy/frigate-hass-card) for
 that card.
 
+Frigate rejects browser connections to its live streams that come from another
+origin, such as a Home Assistant dashboard. Configure cards to stream through the
+integration's proxy rather than pointing them directly at Frigate's port.
+
 ## Configuration
 
 When configuring the integration, you will be asked for the `URL` of your Frigate instance which can be pointed at the internal unauthenticated port (`5000`) or the authenticated port (`8971`) for your instance. This may look like `http://<host>:5000/`.