mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-20 13:42:47 +03:00
Josh HawkinsandGitHub
5bb2cde8b3
CI / AMD64 Build (push) Waiting to run
CI / AMD64 Smoke Test (push) Blocked by required conditions
CI / ARM Build (push) Waiting to run
CI / Jetson Jetpack 6 (push) Waiting to run
CI / AMD64 Extra Build (push) Blocked by required conditions
CI / ARM Extra Build (push) Blocked by required conditions
CI / Synaptics Build (push) Blocked by required conditions
CI / Assemble and push default build (push) Blocked by required conditions
* reject cross-origin websocket handshakes Neither /ws nor the jsmpeg websockets checked Origin, and the internal port grants admin to everyone, so any page a LAN user visited could open ws://frigate:5000/ws and send commands or read streams. Both servers now reject a browser handshake whose Origin host matches neither Host nor X-Forwarded-Host, and allow handshakes without an Origin for non-browser clients. nginx now forwards an outer proxy's X-Forwarded-Host instead of overwriting it, so proxies that rewrite Host and the Home Assistant integration's proxy still match. * apply runtime role changes to jsmpeg streams The output process never subscribed to config/auth, so role edits from the Roles UI (requires_restart 0) did not reach it and jsmpeg kept streaming cameras that had been removed from a role until restart. The output process now replaces its auth config on config/auth updates, which the camera and birdseye broadcast threads read through the shared config. * tidy origin check docstring and auth update comment * reject cross-origin go2rtc stream requests in /auth The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it. * set Host in the nginx proxy doc examples * drain all queued auth updates in the output process * note that cards must stream through the integration proxy * strip the query before matching go2rtc paths in the origin check
59 lines
1.3 KiB
TypeScript
59 lines
1.3 KiB
TypeScript
import path, { resolve } from "path";
|
|
import { defineConfig } from "vite";
|
|
import react from "@vitejs/plugin-react";
|
|
import monacoEditorPlugin from "vite-plugin-monaco-editor";
|
|
|
|
const proxyHost = process.env.PROXY_HOST || "localhost:5000";
|
|
|
|
// https://vitejs.dev/config/
|
|
export default defineConfig({
|
|
server: {
|
|
proxy: {
|
|
"/api": {
|
|
target: `http://${proxyHost}`,
|
|
ws: true,
|
|
},
|
|
"/vod": {
|
|
target: `http://${proxyHost}`,
|
|
},
|
|
"/clips": {
|
|
target: `http://${proxyHost}`,
|
|
},
|
|
"/exports": {
|
|
target: `http://${proxyHost}`,
|
|
},
|
|
"/ws": {
|
|
target: `ws://${proxyHost}`,
|
|
ws: true,
|
|
},
|
|
"/live": {
|
|
target: `ws://${proxyHost}`,
|
|
ws: true,
|
|
},
|
|
},
|
|
},
|
|
build: {
|
|
rolldownOptions: {
|
|
input: {
|
|
main: resolve(import.meta.dirname, "index.html"),
|
|
login: resolve(import.meta.dirname, "login.html"),
|
|
},
|
|
output: {
|
|
keepNames: true,
|
|
},
|
|
},
|
|
},
|
|
plugins: [
|
|
react(),
|
|
monacoEditorPlugin.default({
|
|
customWorkers: [{ label: "yaml", entry: "monaco-yaml/yaml.worker" }],
|
|
languageWorkers: ["editorWorkerService"], // we don't use any of the default languages
|
|
}),
|
|
],
|
|
resolve: {
|
|
alias: {
|
|
"@": path.resolve(import.meta.dirname, "./src"),
|
|
},
|
|
},
|
|
});
|