fix(security): reject non-local origins and bind loopback by default

Srcbook has no authentication and can execute arbitrary code, so the only
thing separating the user's own tab from any other page they have open is
the request origin. Nothing was checking it.

Verified before this change, against a running instance: any web page could
read every provider API key from GET /api/settings, read arbitrary files
from disk via POST /api/file, and — because the websocket accepted any
origin — open a socket and drive cell:update + cell:exec to run code as the
user. The server also bound 0.0.0.0, so all of it was reachable from the
whole network.

Changes:

- New server/security.mts owns the origin allowlist. Local origins on any
  port are allowed, plus anything in SRCBOOK_ALLOWED_ORIGINS. Requests with
  no Origin header are allowed, since browsers always set it on cross-origin
  requests and non-browser clients (the CLI, curl) legitimately omit it.
- HTTP: the 41 per-route cors() calls become one cors + verifyOrigin pair on
  the router. Disallowed origins get a 403 rather than just a missing CORS
  header — CORS alone stops an attacker reading a response, but the request
  still executes, which is all you need for POST /api/settings.
- WebSocket: origin checked via verifyClient, so rejection happens at the
  handshake. Checking in the connection handler is too late; the client
  observes an open socket that is only torn down afterwards.
- Bind 127.0.0.1 unless HOST says otherwise, and warn when it doesn't. This
  makes docker-compose's HOST variable real — it was previously read by
  nothing. Compose now sets HOST=0.0.0.0 because Docker forwards published
  ports to the container IP; host-side exposure stays controlled by
  HOST_BIND, which already defaulted to loopback.
- Guard process.send in the CLI server. It only exists under IPC, so running
  the server directly crashed it right after printing "running at ..." —
  which is how this was found while testing the bind change.

12 tests for the allowlist, covering the substring cases that make this kind
of check go wrong (localhost.evil.com, example.com.evil.com).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: nichochar

docker-compose.yml

@@ -14,6 +14,10 @@ services:
           create_host_path: true
     environment:
       - NODE_ENV=production
-      - HOST=${HOST_BIND:-127.0.0.1}
+      # Bind every interface *inside* the container — Docker forwards published ports
+      # to the container's IP, so binding loopback here would make the port mapping
+      # unreachable. Exposure is controlled by HOST_BIND on the ports line above,
+      # which defaults to loopback on the host.
+      - HOST=0.0.0.0
       - SRCBOOK_INSTALL_DEPS=true
     command: ['pnpm', 'start']

packages/api/dev-server.mts

@@ -3,17 +3,19 @@ import { WebSocketServer as WsWebSocketServer } from 'ws';
 
 import app from './server/http.mjs';
 import webSocketServer from './server/ws.mjs';
+import { bindHost, webSocketServerOptions } from './server/security.mjs';
 
 export { SRCBOOK_DIR } from './constants.mjs';
 
 const server = http.createServer(app);
 
-const wss = new WsWebSocketServer({ server });
+const wss = new WsWebSocketServer({ server, ...webSocketServerOptions });
 wss.on('connection', webSocketServer.onConnection);
 
 const port = process.env.PORT || 2150;
-server.listen(port, () => {
-  console.log(`Server is running at http://localhost:${port}`);
+const host = bindHost();
+server.listen(Number(port), host, () => {
+  console.log(`Server is running at http://${host}:${port}`);
 });
 
 process.on('SIGINT', async function () {

packages/api/index.mts

@@ -2,5 +2,6 @@ import app from './server/http.mjs';
 import wss from './server/ws.mjs';
 import { SRCBOOKS_DIR } from './constants.mjs';
 import { posthog } from './posthog-client.mjs';
+import { bindHost, webSocketServerOptions } from './server/security.mjs';
 
-export { app, wss, SRCBOOKS_DIR, posthog };
+export { app, wss, SRCBOOKS_DIR, posthog, bindHost, webSocketServerOptions };

packages/api/server/http.mts

@@ -35,16 +35,19 @@ import { readdir } from '../fs-utils.mjs';
 import { EXAMPLE_SRCBOOKS } from '../srcbook/examples.mjs';
 import { pathToSrcbook } from '../srcbook/path.mjs';
 import { isSrcmdPath } from '../srcmd/paths.mjs';
+import { corsOptions, verifyOrigin } from './security.mjs';
 
 const app: Application = express();
 
 const router = express.Router();
 
+// Order matters: cors answers preflight requests, verifyOrigin rejects everything
+// from an origin we don't trust, and only then do we parse a body.
+router.use(cors(corsOptions));
+router.use(verifyOrigin);
 router.use(express.json());
 
-router.options('/file', cors());
-
-router.post('/file', cors(), async (req, res) => {
+router.post('/file', async (req, res) => {
   const { file } = req.body as {
     file: string;
   };
@@ -69,14 +72,12 @@ router.post('/file', cors(), async (req, res) => {
   }
 });
 
-router.options('/examples', cors());
-router.get('/examples', cors(), (_, res) => {
+router.get('/examples', (_, res) => {
   return res.json({ result: EXAMPLE_SRCBOOKS });
 });
 
 // Create a new srcbook
-router.options('/srcbooks', cors());
-router.post('/srcbooks', cors(), async (req, res) => {
+router.post('/srcbooks', async (req, res) => {
   const { name, language } = req.body;
 
   // TODO: Zod
@@ -102,8 +103,7 @@ router.post('/srcbooks', cors(), async (req, res) => {
   }
 });
 
-router.options('/srcbooks/:id', cors());
-router.delete('/srcbooks/:id', cors(), async (req, res) => {
+router.delete('/srcbooks/:id', async (req, res) => {
   const { id } = req.params;
   const srcbookDir = pathToSrcbook(id);
   removeSrcbook(srcbookDir);
@@ -113,8 +113,7 @@ router.delete('/srcbooks/:id', cors(), async (req, res) => {
 });
 
 // Import a srcbook from a .src.md file or srcmd text.
-router.options('/import', cors());
-router.post('/import', cors(), async (req, res) => {
+router.post('/import', async (req, res) => {
   const { path, text, url } = req.body;
 
   if (typeof path === 'string' && !isSrcmdPath(path)) {
@@ -143,8 +142,7 @@ router.post('/import', cors(), async (req, res) => {
 });
 
 // Generate a srcbook using AI from a simple string query
-router.options('/generate', cors());
-router.post('/generate', cors(), async (req, res) => {
+router.post('/generate', async (req, res) => {
   const { query } = req.body;
 
   try {
@@ -160,8 +158,7 @@ router.post('/generate', cors(), async (req, res) => {
 });
 
 // Generate a cell using AI from a query string
-router.options('/sessions/:id/generate_cells', cors());
-router.post('/sessions/:id/generate_cells', cors(), async (req, res) => {
+router.post('/sessions/:id/generate_cells', async (req, res) => {
   // @TODO: zod
   const { insertIdx, query } = req.body;
 
@@ -179,8 +176,7 @@ router.post('/sessions/:id/generate_cells', cors(), async (req, res) => {
 });
 
 // Test that the AI generation is working with the current configuration
-router.options('/ai/healthcheck', cors());
-router.get('/ai/healthcheck', cors(), async (_req, res) => {
+router.get('/ai/healthcheck', async (_req, res) => {
   try {
     const result = await healthcheck();
     return res.json({ error: false, result });
@@ -192,8 +188,7 @@ router.get('/ai/healthcheck', cors(), async (_req, res) => {
 });
 
 // Open an existing srcbook by passing a path to the srcbook's directory
-router.options('/sessions', cors());
-router.post('/sessions', cors(), async (req, res) => {
+router.post('/sessions', async (req, res) => {
   const { path } = req.body;
 
   posthog.capture({ event: 'user opened srcbook' });
@@ -213,14 +208,12 @@ router.post('/sessions', cors(), async (req, res) => {
   }
 });
 
-router.get('/sessions', cors(), async (_req, res) => {
+router.get('/sessions', async (_req, res) => {
   const sessions = await listSessions();
   return res.json({ error: false, result: Object.values(sessions).map(sessionToResponse) });
 });
 
-router.options('/sessions/:id', cors());
-
-router.get('/sessions/:id', cors(), async (req, res) => {
+router.get('/sessions/:id', async (req, res) => {
   const { id } = req.params;
 
   try {
@@ -243,8 +236,7 @@ router.get('/sessions/:id', cors(), async (req, res) => {
   }
 });
 
-router.options('/sessions/:id/export-text', cors());
-router.get('/sessions/:id/export-text', cors(), async (req, res) => {
+router.get('/sessions/:id/export-text', async (req, res) => {
   const session = await findSession(req.params.id);
 
   posthog.capture({ event: 'user exported srcbook' });
@@ -261,29 +253,26 @@ router.get('/sessions/:id/export-text', cors(), async (req, res) => {
   }
 });
 
-router.options('/sessions/:id/secrets/:name', cors());
-router.put('/sessions/:id/secrets/:name', cors(), async (req, res) => {
+router.put('/sessions/:id/secrets/:name', async (req, res) => {
   const { id, name } = req.params;
   await associateSecretWithSession(name, id);
   await updateSessionEnvTypeDeclarations(id);
   return res.status(204).end();
 });
 
-router.delete('/sessions/:id/secrets/:name', cors(), async (req, res) => {
+router.delete('/sessions/:id/secrets/:name', async (req, res) => {
   const { id, name } = req.params;
   await disassociateSecretWithSession(name, id);
   await updateSessionEnvTypeDeclarations(id);
   return res.status(204).end();
 });
 
-router.options('/settings', cors());
-
-router.get('/settings', cors(), async (_req, res) => {
+router.get('/settings', async (_req, res) => {
   const config = await getConfig();
   return res.json({ error: false, result: config });
 });
 
-router.post('/settings', cors(), async (req, res) => {
+router.post('/settings', async (req, res) => {
   try {
     const updated = await updateConfig(req.body);
 
@@ -300,39 +289,34 @@ router.post('/settings', cors(), async (req, res) => {
   }
 });
 
-router.options('/secrets', cors());
-
-router.get('/secrets', cors(), async (_req, res) => {
+router.get('/secrets', async (_req, res) => {
   const secrets = await getSecrets();
   return res.json({ result: secrets });
 });
 
 // Create a new secret
-router.post('/secrets', cors(), async (req, res) => {
+router.post('/secrets', async (req, res) => {
   const { name, value } = req.body;
   posthog.capture({ event: 'user created secret' });
   const updated = await addSecret(name, value);
   return res.json({ result: updated });
 });
 
-router.options('/secrets/:name', cors());
-
-router.post('/secrets/:name', cors(), async (req, res) => {
+router.post('/secrets/:name', async (req, res) => {
   const { name } = req.params;
   const { name: newName, value } = req.body;
   await removeSecret(name);
   const updated = await addSecret(newName, value);
   return res.json({ result: updated });
 });
 
-router.delete('/secrets/:name', cors(), async (req, res) => {
+router.delete('/secrets/:name', async (req, res) => {
   const { name } = req.params;
   const updated = await removeSecret(name);
   return res.json({ result: updated });
 });
 
-router.options('/feedback', cors());
-router.post('/feedback', cors(), async (req, res) => {
+router.post('/feedback', async (req, res) => {
   const { feedback, email } = req.body;
   // Every time you modify the appscript here, you'll need to update the URL below
   // @TODO: once we have an env variable setup, we can use that here.
@@ -361,8 +345,7 @@ type NpmSearchResult = {
  * Returns the name, version and description of the packages.
  * Consider debouncing calls to this API on the client side.
  */
-router.options('/npm/search', cors());
-router.get('/npm/search', cors(), async (req, res) => {
+router.get('/npm/search', async (req, res) => {
   const { q, size } = req.query;
   const response = await fetch(`https://registry.npmjs.org/-/v1/search?text=${q}&size=${size}`);
   if (!response.ok) {
@@ -375,8 +358,7 @@ router.get('/npm/search', cors(), async (req, res) => {
   return res.json({ result: results });
 });
 
-router.options('/subscribe', cors());
-router.post('/subscribe', cors(), async (req, res) => {
+router.post('/subscribe', async (req, res) => {
   const { email } = req.body;
   const hubResponse = await fetch('https://hub.srcbook.com/api/subscribe', {
     method: 'POST',