mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-27 08:54:42 +03:00
Josh HawkinsandGitHub
5bb2cde8b3
CI / AMD64 Build (push) Canceled after 0s
CI / AMD64 Smoke Test (push) Canceled after 0s
CI / ARM Build (push) Canceled after 0s
CI / Jetson Jetpack 6 (push) Canceled after 0s
CI / AMD64 Extra Build (push) Canceled after 0s
CI / ARM Extra Build (push) Canceled after 0s
CI / Synaptics Build (push) Canceled after 0s
CI / Assemble and push default build (push) Canceled after 0s
* reject cross-origin websocket handshakes Neither /ws nor the jsmpeg websockets checked Origin, and the internal port grants admin to everyone, so any page a LAN user visited could open ws://frigate:5000/ws and send commands or read streams. Both servers now reject a browser handshake whose Origin host matches neither Host nor X-Forwarded-Host, and allow handshakes without an Origin for non-browser clients. nginx now forwards an outer proxy's X-Forwarded-Host instead of overwriting it, so proxies that rewrite Host and the Home Assistant integration's proxy still match. * apply runtime role changes to jsmpeg streams The output process never subscribed to config/auth, so role edits from the Roles UI (requires_restart 0) did not reach it and jsmpeg kept streaming cameras that had been removed from a role until restart. The output process now replaces its auth config on config/auth updates, which the camera and birdseye broadcast threads read through the shared config. * tidy origin check docstring and auth update comment * reject cross-origin go2rtc stream requests in /auth The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it. * set Host in the nginx proxy doc examples * drain all queued auth updates in the output process * note that cards must stream through the integration proxy * strip the query before matching go2rtc paths in the origin check
32 lines
969 B
Python
32 lines
969 B
Python
"""Same-origin check for browser WebSocket handshakes and go2rtc stream requests."""
|
|
|
|
from urllib.parse import urlsplit
|
|
|
|
|
|
def _hostname(value: str) -> str | None:
|
|
try:
|
|
return urlsplit(value).hostname
|
|
except ValueError:
|
|
return None
|
|
|
|
|
|
def origin_allowed(
|
|
origin: str | None, host: str | None, forwarded_host: str | None
|
|
) -> bool:
|
|
"""Return True unless a browser sent the request from a foreign origin.
|
|
|
|
Browsers always send Origin on a WebSocket handshake, so a missing Origin
|
|
means a non-browser client. A page cannot add headers to a handshake, so
|
|
X-Forwarded-Host comes from a proxy. Ports are ignored because nginx
|
|
forwards Host without one.
|
|
"""
|
|
if origin is None:
|
|
return True
|
|
|
|
origin_host = _hostname(origin)
|
|
if not origin_host:
|
|
return False
|
|
|
|
hosts = ((forwarded_host or "").split(",")[0].strip(), host or "")
|
|
return any(origin_host == _hostname(f"//{h}") for h in hosts if h)
|