mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-19 21:22:50 +03:00

Files

T

Josh Hawkins ab8b41934c reject cross-origin websocket handshakes

Neither /ws nor the jsmpeg websockets checked Origin, and the internal port grants admin to everyone, so any page a LAN user visited could open ws://frigate:5000/ws and send commands or read streams. Both servers now reject a browser handshake whose Origin host matches neither Host nor X-Forwarded-Host, and allow handshakes without an Origin for non-browser clients. nginx now forwards an outer proxy's X-Forwarded-Host instead of overwriting it, so proxies that rewrite Host and the Home Assistant integration's proxy still match.

2026-10-18 12:14:30 -05:00

data

Merge remote-tracking branch 'origin/master' into dev

2026-10-02 06:39:23 -05:00

docs

reject cross-origin websocket handshakes

2026-10-18 12:14:30 -05:00

plugins

Miscellaneous fixes (#23648 )

2026-07-07 10:56:43 -06:00

scripts

Implement UI for managing multiple models (#24023 )