Josh Hawkins 31c3638767 reject cross-origin go2rtc stream requests in /auth ...

The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it.

2026-10-18 12:40:12 -05:00

..

auth_location.conf

reject cross-origin go2rtc stream requests in /auth

2026-10-18 12:40:12 -05:00

auth_request.conf

UI viewer role (#16978)

2025-03-08 10:01:08 -06:00

go2rtc_upstream.conf

TLS support (#11678)

2024-06-01 10:29:46 -05:00

nginx.conf

reject cross-origin websocket handshakes

2026-10-18 12:14:30 -05:00

proxy_trusted_headers.conf

fix: additional proxy headers for complete support of oauth2-proxy (#21434)

2025-12-27 07:33:25 -06:00

proxy.conf

reject cross-origin websocket handshakes

2026-10-18 12:14:30 -05:00

security_headers.conf

Container security hardening (phase 1) (#24061)

2026-09-12 07:30:04 -06:00