From 96fa39bbf7924f9acdd44f79e986b39e1a77684d Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:12:32 -0500
Subject: [PATCH] strip the query before matching go2rtc paths in the origin
 check

---
 frigate/api/auth.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/frigate/api/auth.py b/frigate/api/auth.py
index 940dbd7ca1..d080258d41 100644
--- a/frigate/api/auth.py
+++ b/frigate/api/auth.py
@@ -1300,9 +1300,8 @@ def _is_cross_origin_stream_request(original_url: str | None, request: Request)
     # the internal port grants admin, so a browser on another site must be
     # stopped before that early return
     upgrade = request.headers.get("x-original-upgrade", "").lower()
-    if upgrade != "websocket" and not _is_go2rtc_stream_proxy_request(
-        original_url or "", request
-    ):
+    path = split_request_uri(original_url or "")[0]
+    if upgrade != "websocket" and not _is_go2rtc_stream_proxy_request(path, request):
         return False
 
     return not origin_allowed(