Gateway: allow extension origins in browser allowlist

brunowowk · brunowowk · commit e252c8ae62da · 2026-03-06T13:00:17.000-03:00
diff --git a/src/gateway/origin-check.test.ts b/src/gateway/origin-check.test.ts
@@ -49,6 +49,24 @@ describe("checkBrowserOrigin", () => {
     expect(result.ok).toBe(true);
   });
 
+  it("accepts allowlisted chrome extension origins", () => {
+    const result = checkBrowserOrigin({
+      requestHost: "127.0.0.1:18789",
+      origin: "chrome-extension://abcdefghijklmnop",
+      allowedOrigins: ["chrome-extension://abcdefghijklmnop"],
+    });
+    expect(result.ok).toBe(true);
+  });
+
+  it("rejects mismatched chrome extension origins", () => {
+    const result = checkBrowserOrigin({
+      requestHost: "127.0.0.1:18789",
+      origin: "chrome-extension://abcdefghijklmnop",
+      allowedOrigins: ["chrome-extension://qrstuvwxyzabcdef"],
+    });
+    expect(result.ok).toBe(false);
+  });
+
   it("accepts wildcard allowedOrigins", () => {
     const result = checkBrowserOrigin({
       requestHost: "gateway.example.com:18789",
diff --git a/src/gateway/origin-check.ts b/src/gateway/origin-check.ts
@@ -7,17 +7,27 @@ type OriginCheckResult =
     }
   | { ok: false; reason: string };
 
+function normalizeOriginForMatch(url: URL): string {
+  const normalizedOrigin = url.origin.toLowerCase();
+  if (normalizedOrigin !== "null") {
+    return normalizedOrigin;
+  }
+  // Non-standard schemes like chrome-extension://<id> stringify to origin === "null",
+  // but still have a stable scheme + host that operators can allowlist exactly.
+  return `${url.protocol}//${url.host}`.toLowerCase();
+}
+
 function parseOrigin(
   originRaw?: string,
-): { origin: string; host: string; hostname: string } | null {
+): { matchOrigin: string; host: string; hostname: string } | null {
   const trimmed = (originRaw ?? "").trim();
   if (!trimmed || trimmed === "null") {
     return null;
   }
   try {
     const url = new URL(trimmed);
     return {
-      origin: url.origin.toLowerCase(),
+      matchOrigin: normalizeOriginForMatch(url),
       host: url.host.toLowerCase(),
       hostname: url.hostname.toLowerCase(),
     };
@@ -26,6 +36,17 @@ function parseOrigin(
   }
 }
 
+function normalizeAllowedOrigin(originRaw: string): string | null {
+  const trimmed = originRaw.trim();
+  if (!trimmed) {
+    return null;
+  }
+  if (trimmed === "*") {
+    return "*";
+  }
+  return parseOrigin(trimmed)?.matchOrigin ?? null;
+}
+
 export function checkBrowserOrigin(params: {
   requestHost?: string;
   origin?: string;
@@ -39,9 +60,9 @@ export function checkBrowserOrigin(params: {
   }
 
   const allowlist = new Set(
-    (params.allowedOrigins ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean),
+    (params.allowedOrigins ?? []).map(normalizeAllowedOrigin).filter(Boolean),
   );
-  if (allowlist.has("*") || allowlist.has(parsedOrigin.origin)) {
+  if (allowlist.has("*") || allowlist.has(parsedOrigin.matchOrigin)) {
     return { ok: true, matchedBy: "allowlist" };
   }
 
diff --git a/src/gateway/server.auth.browser-hardening.test.ts b/src/gateway/server.auth.browser-hardening.test.ts
@@ -73,6 +73,29 @@ async function createSignedDevice(params: {
 }
 
 describe("gateway auth browser hardening", () => {
+  test("accepts allowlisted chrome extension origins for browser ws clients", async () => {
+    testState.gatewayAuth = { mode: "token", token: "secret" };
+    testState.gatewayControlUi = {
+      allowedOrigins: ["chrome-extension://abcdefghijklmnop"],
+    };
+    await withGatewayServer(async ({ port }) => {
+      const ws = await openWs(port, {
+        origin: "chrome-extension://abcdefghijklmnop",
+      });
+      try {
+        const res = await connectReq(ws, {
+          token: "secret",
+          client: TEST_OPERATOR_CLIENT,
+          device: null,
+        });
+        expect(res.ok).toBe(true);
+        expect((res.payload as { type?: string } | undefined)?.type).toBe("hello-ok");
+      } finally {
+        ws.close();
+      }
+    });
+  });
+
   test("rejects non-local browser origins for non-control-ui clients", async () => {
     testState.gatewayAuth = { mode: "token", token: "secret" };
     await withGatewayServer(async ({ port }) => {
