Skip to content

feat: configurable VITE_WS_API_URL + harden POST→GET shim#480

Merged
koala73 merged 2 commits into
mainfrom
fix/post-to-get-compat
Feb 27, 2026
Merged

feat: configurable VITE_WS_API_URL + harden POST→GET shim#480
koala73 merged 2 commits into
mainfrom
fix/post-to-get-compat

Conversation

@koala73

@koala73 koala73 commented Feb 27, 2026

Copy link
Copy Markdown
Owner

Summary

Follow-up to #477 (merged with only the initial POST→GET shim).

  • Hardened body parsing — Scalar-only type guard (skip objects/nested), Content-Length < 1MB check to prevent prototype pollution and memory pressure
  • Configurable API URL — Replace hardcoded api.worldmonitor.app with VITE_WS_API_URL env var. When empty, installWebApiRedirect() is skipped — relative /api/* calls stay on same domain (local installs). When set, browser fetch redirects to that URL.
  • Dynamic APP_HOSTS — VITE_WS_API_URL and VITE_WS_RELAY_URL hostnames added to allowlist automatically

Deployment note

Set VITE_WS_API_URL=https://api.worldmonitor.app in Vercel environment variables before merging. Without it, the web API redirect won't activate on production.

Test plan

  • tsc --noEmit passes
  • With VITE_WS_API_URL=https://api.worldmonitor.app: /api/* calls redirect correctly
  • With VITE_WS_API_URL empty: /api/* calls stay on same domain
  • POST to converted endpoints still returns 200 (scalar params converted)
  • Large POST bodies (>1MB) gracefully fall through to 404

@koala73
fix(gateway): harden POST→GET shim with scalar guard and size limit
ae98380 
- Only convert string/number/boolean values to query params (skip objects,
  nested arrays, __proto__ etc.) to prevent prototype pollution vectors
- Skip body parsing for Content-Length > 1MB to avoid memory pressure
@koala73
feat: make API base URL configurable via VITE_WS_API_URL
feead22 
Replace hardcoded api.worldmonitor.app with VITE_WS_API_URL env var.
When empty, installWebApiRedirect() is skipped entirely — relative
/api/* calls stay on the same domain (local installs). When set,
browser fetch is redirected to that URL.

Also adds VITE_WS_API_URL and VITE_WS_RELAY_URL hostnames to
APP_HOSTS allowlist dynamically.
@vercel

vercel Bot commented Feb 27, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
worldmonitor Building Building Preview, Comment Feb 27, 2026 6:20pm
worldmonitor-finance Building Building Preview, Comment Feb 27, 2026 6:20pm
worldmonitor-happy Building Building Preview, Comment Feb 27, 2026 6:20pm
worldmonitor-startup Building Building Preview, Comment Feb 27, 2026 6:20pm

Request Review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Feb 27, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@koala73
koala73 merged commit b87402b into main Feb 27, 2026
6 checks passed
@koala73
koala73 deleted the fix/post-to-get-compat branch February 27, 2026 20:51
koala73 added a commit that referenced this pull request Mar 1, 2026
@koala73
feat: configurable VITE_WS_API_URL + harden POST→GET shim (#480)
2399b53 
* fix(gateway): harden POST→GET shim with scalar guard and size limit

- Only convert string/number/boolean values to query params (skip objects,
  nested arrays, __proto__ etc.) to prevent prototype pollution vectors
- Skip body parsing for Content-Length > 1MB to avoid memory pressure

* feat: make API base URL configurable via VITE_WS_API_URL

Replace hardcoded api.worldmonitor.app with VITE_WS_API_URL env var.
When empty, installWebApiRedirect() is skipped entirely — relative
/api/* calls stay on the same domain (local installs). When set,
browser fetch is redirected to that URL.

Also adds VITE_WS_API_URL and VITE_WS_RELAY_URL hostnames to
APP_HOSTS allowlist dynamically.
koala73 added a commit that referenced this pull request Mar 1, 2026
@koala73 @SebastienMelki
@claude @Konstantysz @fuleinist @facusturla @princelevant @devalnor @elzalem @FayezBast @Yigtwxx