Fix how allowed domains are checked - origin not host

2026-06-28 11:00:55 +03:00 · 2024-02-27 12:54:01 +05:30
parent 7d76c127f1
commit 930bdd5c51
1 changed files with 4 additions and 2 deletions
@@ -1224,11 +1224,13 @@ export class App {
                })
                if (!chatflow) return res.status(404).send(`Chatflow ${req.params.id} not found`)
                let isDomainAllowed = true
-                logger.info(`[server]: Request originated from ${req.headers.host}`)
+                logger.info(`[server]: Request originated from ${req.headers.origin}`)
                if (chatflow.chatbotConfig) {
                    const parsedConfig = JSON.parse(chatflow.chatbotConfig)
                    if (parsedConfig.allowedOrigins && parsedConfig.allowedOrigins.length > 0) {
-                        isDomainAllowed = parsedConfig.allowedOrigins.includes(req.headers.host)
+                        const originHeader = req.headers.origin as string
+                        const origin = new URL(originHeader).host
+                        isDomainAllowed = parsedConfig.allowedOrigins.includes(origin)
                    }
                }