Function rejectIfNotLoopbackApi

packages/cli/src/commands/ui-proxy.ts:38–69

(req: IncomingMessage, res: ServerResponse)

const DEFAULT_UPSTREAM_TIMEOUT_MS = 10_000;

export function rejectIfNotLoopbackApi(req: IncomingMessage, res: ServerResponse): boolean {
  const peerAddress = req.socket?.remoteAddress;
  if (peerAddress !== undefined && !isLoopbackAddress(peerAddress)) {
    emitProblem(
      res,
      403,
      'urn:ok:error:loopback-required',
      'Request must originate from a loopback address.',
    );
    return true;
  }
  if (!isAllowedWorkspaceHostHeader(req.headers.host)) {
    emitProblem(
      res,
      403,
      'urn:ok:error:host-not-allowed',
      'Host header is not in the loopback allowlist.',
    );
    return true;
  }
  const origin = req.headers.origin;
  if (origin !== undefined && !isAllowedApiOrigin(origin)) {
    emitProblem(
      res,
      403,
      'urn:ok:error:invalid-origin',
      'Origin header is not in the loopback allowlist.',
    );
    return true;
  }
  return false;
}

/** Per-request client-side deadline — prevents a malicious/local slow-loris peer
 * from pinning the proxy socket indefinitely. 30s leaves ample margin over the