[repo-health] Medium: observer.mjs missing CORS headers — any browser tab can read agent session data

[Liohtml]

Summary

The Observer HTTP server in assets/observer.mjs sends no Access-Control-Allow-Origin header. Because the server listens on 0.0.0.0 inside the container with the port published to 127.0.0.1:4317 on the host, any browser tab open on the same machine can make cross-origin fetch requests to http://localhost:4317/api/sessions and read live agent session metadata (project paths, session IDs, sizes, timestamps).

Category

Security

Severity

Medium

Location

• File: assets/observer.mjs
• Route: GET /api/sessions

Details

The browser Same-Origin Policy does NOT block cross-origin reads when the server sends no CORS headers — browsers apply a permissive default (reads succeed) for responses that carry no Access-Control-Allow-Origin. A malicious or compromised webpage open in any tab while agentbox is running can silently enumerate all active Claude project directories and session files on the host. This leaks filesystem paths and confirms which projects are being worked on.

Note: this is distinct from the XSS finding in issue #2 (which covers unescaped project names in innerHTML). Even without XSS, the API endpoint itself is directly readable cross-origin.

Suggested Fix

Add an explicit restrictive CORS header to the /api/sessions handler so only localhost origins are allowed:

// In the /api/sessions handler, before res.end():
res.writeHead(200, {
  "content-type": "application/json",
  "cache-control": "no-store",
  "Access-Control-Allow-Origin": "null",  // blocks cross-origin reads
  // OR restrict to the specific local origin:
  // "Access-Control-Allow-Origin": "http://localhost:4317",
});

Setting Access-Control-Allow-Origin: null explicitly blocks cross-origin reads (null origin is the opaque origin for cross-origin iframes, not the same as omitting the header). Alternatively, validate the Origin request header and only echo it back if it matches localhost.

Effort Estimate

5 min

---

Automated finding by repo-health-agent v1.0