rebase(desktop): kaushik-IDE onto main (SSH tunnel + CORS) - #38
Draft
venkateshsakamuri-lab wants to merge 2 commits into
Draft
rebase(desktop): kaushik-IDE onto main (SSH tunnel + CORS)#38venkateshsakamuri-lab wants to merge 2 commits into
venkateshsakamuri-lab wants to merge 2 commits into
Conversation
Connecting to a VM through the SSH tunnel failed with "Request failed with status code 403" as soon as the user tried to log in. The tunnel serves the web app from http://127.0.0.1:<sticky port>, not the VM's hostname, and a self-host deployment that sets CORS_ALLOWED_ORIGINS to its public hostname replaces the built-in list rather than extending it. Spring treats any request carrying Origin as cross-origin (the same-origin short-circuit went away in 5.3), so the backend answered 403 with the plain-text body "Invalid CORS request". That body has no `message` field, so client.js's axios interceptor fell through to axios's own wording — an error naming neither CORS nor the origin. It hid well: Chromium omits Origin on same-origin GETs, so the health probe, the SPA and every read succeeded and the connection tested green. Only the first POST — the login — failed. - probe.js sends an Origin header, so the rejection is caught at connect time rather than at the user's first login, and transport.js reports it as `cors-rejected` naming the origin and the exact allowlist to set. - Loopback entries in the shipped defaults now carry a port wildcard, since the tunnel's local port is chosen at runtime. Legal only because SecurityConfig uses setAllowedOriginPatterns. - .env.example, docker-compose.yml and desktop/README.md spell out that CORS_ALLOWED_ORIGINS replaces the list, which is how the loopback entries go missing. - CLAUDE.md and config.js drop the "zero backend changes" claim: CORS is the one setting the thin client does require. - tunnel-selftest.js grows two checks (14/14) covering the Origin header and a 403 from an allowlist that omits the origin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
@urstrulykkr do you wanna rebase again on main latest, fix the developer tool issues and raise PR again? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebases Kaushik’s
kaushik-IDEdesktop work onto latestmainso the SSH-tunnel desktop client picks up main’s agent-runtime and related fixes.kaushik-IDEwas also force-updated to the same tip (b7037f1) after a clean rebase (no conflicts).Commits on top of main
desktop-client init— DeepSQL Desktop Electron thin client (TLS + SSH tunnel)fix(desktop): allow loopback origins so tunnel connections pass CORS— probe sendsOrigin, loopback port wildcards in CORS defaults, clearercors-rejectederrorsWhy
Main landed agent-runtime / self-host / CLI fixes after the desktop branch diverged. Rebase keeps the desktop + CORS tunnel fix while inheriting those.
Test plan
git rebase origin/mainclean (no conflicts)npm run selftest:tunnelindesktop/(14/14)npm run smokevia real SSH → frontend:3000Invalid CORS request)Notes
CORS_ALLOWED_ORIGINSmust keephttp://127.0.0.1:*,http://localhost:*alongside the public hostname, or tunnel logins 403.--host 127.0.0.1) because the tunnel forwards to127.0.0.1.