fix: CSRF and WS origin check trust request Host header (same-origin)

internal/gateway/client.go

@@ -26,8 +26,11 @@ var upgrader = websocket.Upgrader{
 }
 
 // SetAllowedOrigins replaces the default upgrader with one that validates
-// the Origin header against a trusted set. Call once at startup.
-// Exact matches are checked first, then hostname-based matching is used.
+// the Origin header. Accepts if:
+// 1. Exact match in origins list, OR
+// 2. Hostname matches a trusted hostname, OR
+// 3. Hostname matches the request's own Host header (same-origin), OR
+// 4. Localhost variant
 func SetAllowedOrigins(origins []string) {
 	originSet := make(map[string]struct{}, len(origins))
 	hostSet := make(map[string]struct{}, len(origins))
@@ -53,34 +56,50 @@ func SetAllowedOrigins(origins []string) {
 		CheckOrigin: func(r *http.Request) bool {
 			origin := r.Header.Get("Origin")
 			if origin == "" {
-				return true // non-browser clients
+				return true
 			}
 			if _, ok := originSet[origin]; ok {
 				return true
 			}
-			oh := origin
-			if idx := strings.Index(oh, "://"); idx >= 0 {
-				oh = oh[idx+3:]
-			}
-			if idx := strings.Index(oh, "/"); idx >= 0 {
-				oh = oh[:idx]
-			}
-			if idx := strings.LastIndex(oh, ":"); idx >= 0 {
-				oh = oh[:idx]
-			}
-			oh = strings.TrimPrefix(oh, "[")
-			oh = strings.TrimSuffix(oh, "]")
+			oh := extractHostname(origin)
+
+			// Match trusted hostnames
 			if _, ok := hostSet[oh]; ok {
 				return true
 			}
+
+			// Match request's own Host header (same-origin)
+			reqHost := extractHostname(r.Host)
+			if reqHost != "" && oh == reqHost {
+				return true
+			}
+
+			// Localhost variants
 			if oh == "localhost" || oh == "127.0.0.1" || oh == "::1" {
 				return true
 			}
+
 			return false
 		},
 	}
 }
 
+func extractHostname(s string) string {
+	h := s
+	if idx := strings.Index(h, "://"); idx >= 0 {
+		h = h[idx+3:]
+	}
+	if idx := strings.Index(h, "/"); idx >= 0 {
+		h = h[:idx]
+	}
+	if idx := strings.LastIndex(h, ":"); idx >= 0 {
+		h = h[:idx]
+	}
+	h = strings.TrimPrefix(h, "[")
+	h = strings.TrimSuffix(h, "]")
+	return h
+}
+
 // Client is a middleman between the websocket connection and the hub.
 type Client struct {
 	Hub    *Hub

internal/middleware/csrf.go

@@ -6,16 +6,13 @@ import (
 )
 
 // CSRFProtect returns middleware that validates the Origin header on
-// state-changing methods (POST, PUT, PATCH, DELETE). Requests from origins
-// not in the trustedOrigins list are rejected with 403. Non-browser clients
-// (curl, bots) that send no Origin or Referer header are allowed through,
-// since they are not subject to CSRF.
+// state-changing methods (POST, PUT, PATCH, DELETE).
 //
-// If host is non-empty, any Origin whose hostname matches host is allowed.
-// additionalOrigins is a list of extra fully-qualified origins to trust
-// (e.g. from environment variable DUMPSTER_CSRF_ORIGINS, comma-separated).
+// An origin is trusted if:
+// 1. It's in the explicit additionalOrigins list, OR
+// 2. Its hostname matches the configured host, OR
+// 3. Its hostname matches the request's own Host header (same-origin check)
 func CSRFProtect(host, port string, additionalOrigins []string) func(http.Handler) http.Handler {
-	// Build a set of exact-match origins for quick lookup
 	originSet := make(map[string]struct{})
 	for _, o := range additionalOrigins {
 		o = strings.TrimSpace(o)
@@ -24,7 +21,6 @@ func CSRFProtect(host, port string, additionalOrigins []string) func(http.Handle
 		}
 	}
 
-	// Extract hostname from host (strip port if present)
 	hostname := host
 	if idx := strings.LastIndex(hostname, ":"); idx > 0 {
 		hostname = hostname[:idx]
@@ -36,7 +32,6 @@ func CSRFProtect(host, port string, additionalOrigins []string) func(http.Handle
 			case "POST", "PUT", "PATCH", "DELETE":
 				origin := r.Header.Get("Origin")
 				if origin == "" {
-					// Fallback: extract origin from Referer
 					referer := r.Header.Get("Referer")
 					if referer != "" {
 						for o := range originSet {
@@ -49,35 +44,32 @@ func CSRFProtect(host, port string, additionalOrigins []string) func(http.Handle
 				}
 
 				if origin != "" {
-					if !isOriginTrusted(origin, hostname, port, originSet) {
+					// Extract request host for same-origin check
+					reqHost := r.Host
+					if idx := strings.LastIndex(reqHost, ":"); idx > 0 {
+						reqHost = reqHost[:idx]
+					}
+
+					if !isOriginTrusted(origin, hostname, port, reqHost, originSet) {
 						http.Error(w, `{"error":"forbidden origin"}`, http.StatusForbidden)
 						return
 					}
 				}
-				// If both Origin and Referer are empty, allow through
-				// (non-browser client like curl, bots, mobile apps)
 			}
 			next.ServeHTTP(w, r)
 		})
 	}
 }
 
-// isOriginTrusted checks if the given Origin header value is trusted.
-// An origin is trusted if:
-// 1. It's in the explicit originSet, OR
-// 2. Its hostname matches the configured host (any scheme/port)
-func isOriginTrusted(origin, host, port string, originSet map[string]struct{}) bool {
+func isOriginTrusted(origin, host, port, reqHost string, originSet map[string]struct{}) bool {
 	if _, ok := originSet[origin]; ok {
 		return true
 	}
 
-	// Parse the origin to extract hostname and port
-	// Origin format: scheme://host[:port]
 	withoutScheme := origin
 	if idx := strings.Index(withoutScheme, "://"); idx >= 0 {
 		withoutScheme = withoutScheme[idx+3:]
 	}
-	// Remove path if any
 	if idx := strings.Index(withoutScheme, "/"); idx >= 0 {
 		withoutScheme = withoutScheme[:idx]
 	}
@@ -89,15 +81,20 @@ func isOriginTrusted(origin, host, port string, originSet map[string]struct{}) b
 		originHost = originHost[:idx]
 	}
 
-	// Strip brackets from IPv6
 	originHost = strings.TrimPrefix(originHost, "[")
 	originHost = strings.TrimSuffix(originHost, "]")
 
+	// Match configured host
 	if host != "" && originHost == host {
 		return true
 	}
 
-	// Also trust localhost variants
+	// Match request's own Host header (same-origin)
+	if reqHost != "" && originHost == reqHost {
+		return true
+	}
+
+	// Localhost variants
 	if originHost == "localhost" || originHost == "127.0.0.1" || originHost == "::1" {
 		if port == "" || originPort == "" || originPort == port {
 			return true