[dr0uleau]

Why

A browser preview behind an HTTPS proxy sends its HTTPS Origin to the loopback broker. The broker needs an explicit origin setting to serve that preview.

What

Add the optional browserOrigin setting to relayBrokerPlugin. It accepts one HTTPS origin from trusted server configuration. The setting is an explicit opt-in and requires the Vite server in development mode.

How

The broker retains its loopback listener, loopback Host check, and same-origin request checks. The setting does not authenticate remote clients. The proxy must provide authentication. The default remains the HTTP loopback origin.

Risk

This affects the development broker only when the setting is present. Builds, production mode, and other modes reject the setting before identity access. An incorrect value prevents startup or blocks requests. Native and release hosts do not use it.

Testing

The regression checks exercise a real Vite loopback server with a disposable identity. They cover an accepted HTTPS request, an accepted POST, and refusal of other origins, cross-site requests, missing POST Origin, and a non-loopback Host. Vite config checks reject the option for production serve and development/production builds. The existing loopback checks also pass.

The author opens the hosted simulated preview on the laptop at 2419dcce and confirms it works. The later guard only rejects other configurations. The same development flow passes agent checks at 18d9720e. Independent review covers that final revision and reports no findings.

buzz-review-completed

Generated with Codex