Method handleWebSocket

src/Server/WebTerminalRequestHandler.cpp:347–498

void WebTerminalRequestHandler::handleWebSocket(HTTPServerRequest & request, HTTPServerResponse & response)
{
    auto log = getLogger("WebTerminalHandler");

    /// Require GET method for WebSocket upgrade per RFC 6455
    if (request.getMethod() != HTTPRequest::HTTP_GET)
    {
        response.setStatusAndReason(Poco::Net::HTTPResponse::HTTP_METHOD_NOT_ALLOWED);
        *response.send() << "WebSocket upgrade requires GET method.\n";
        return;
    }

    /// Validate WebSocket upgrade headers per RFC 6455
    String ws_key = request.get("Sec-WebSocket-Key", "");
    if (!isValidWebSocketKey(ws_key))
    {
        response.setStatusAndReason(Poco::Net::HTTPResponse::HTTP_BAD_REQUEST);
        *response.send() << "Invalid or missing Sec-WebSocket-Key.\n";
        return;
    }

    /// RFC 6455 fixed the WebSocket protocol at version 13; earlier drafts
    /// (00, 7, 8, etc.) are obsolete and not implemented here.
    String ws_version = request.get("Sec-WebSocket-Version", "");
    if (ws_version != "13")
    {
        response.set("Sec-WebSocket-Version", "13");
        response.setStatusAndReason(Poco::Net::HTTPResponse::HTTP_BAD_REQUEST);
        *response.send() << "Unsupported WebSocket version.\n";
        return;
    }

    /// Validate Origin header to prevent cross-site WebSocket hijacking.
    /// Browsers always send the Origin header on WebSocket upgrades, so a
    /// missing `Origin` is either a non-browser client or a malicious
    /// upgrade. We refuse the request rather than allow it through: this is
    /// an interactive PTY, the cost of accepting a forged or unattributed
    /// origin is too high. Non-browser test clients must send a synthetic
    /// `Origin` matching the request host (see `tests/integration/test_webterminal`).
    ///
    /// By default, we enforce same-origin: the Origin must match the request in
    /// both scheme (`http`/`https`) and host/port. Comparing only host would
    /// allow a less-trusted page served over `http` on the same host to open a
    /// WebSocket against `https`, weakening CSWSH protection.
    ///
    /// Behind a TLS-terminating reverse proxy, `request.isSecure()` is `false`
    /// even when the browser sees `https`, so the strict check would reject
    /// legitimate same-origin connections. For such deployments, operators can
    /// set `webterminal_allowed_origins` in the server config to a
    /// comma-separated list of full origins (e.g.
    /// `https://example.com,https://app.example.com:8443`); when non-empty,
    /// this allowlist replaces the same-origin check.
    String origin = request.get("Origin", "");
    if (origin.empty())
    {
        LOG_WARNING(log, "WebSocket upgrade rejected: missing Origin header");
        response.setStatusAndReason(Poco::Net::HTTPResponse::HTTP_FORBIDDEN);
        *response.send() << "Origin header is required.\n";