Desktop: authenticate local runtime requests - #397
Merged
Conversation
priethor
added
type: enhancement
Blocking every third-party subframe made the Embed block render blank. The token now rides only on requests whose frame origin is Cortext's own, so a provider iframe renders while its requests, nested frames, popups, and service workers stay unauthenticated at the runtime. A request with no frame behind it is never authenticated, and an embedded frame cannot navigate the app window either.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Require a new random token on every launch before the desktop app serves WordPress or static files. Direct requests to the fixed localhost port now get
403; Cortext can still reload and open internal links in new windows.External links open in the system browser. The app blocks external frames and document redirects from entering its private session. Desktop publishing and copy-link controls stay hidden, and published localhost URLs remain unavailable outside the app.
Why
Desktop autologin makes every accepted WordPress request an administrator request. A web page or accidental localhost client should not gain that access just by knowing the port.
How
All Cortext windows share a dedicated Electron session that keeps browser preferences between launches but never stores the token. Older desktop builds kept these preferences in Electron's default session, so this move resets them once. WordPress data and app settings are unchanged.
The PHP router and the experimental Caddy runtimes check the token before serving content. Caddy removes the header before PHP and redacts it from error logs.
Testing Instructions
Cmd+Rand confirm that Cortext returns instead of showing "Forbidden".curl -i http://127.0.0.1:9402/wp-includes/images/blank.gifand confirm that it returns403 Forbidden.I used Claude to help implement these changes. I guided the work, then tested and reviewed the result.