Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneesstack72

Relationships

#1840 serve: dashboard behind an ingress fails WS handshake — Origin allowlist is hardcoded

Opened by stack72 · 8/26/2026· Shipped 8/26/2026

swamp serve --dashboard behind an HTTPS ingress (Traefik in k3s here) serves the SPA fine, but the dashboard's own WebSocket back to the server is rejected before auth:

system │ WebSocket upgrade rejected: "untrusted origin: https://swamp.k3s-dev.cicd.pd.hmq.dev" from "10.42.0.0"

The pod binds 0.0.0.0:9090 with TLS + oauth. Chart config sets trustedHosts: [swamp.k3s-dev.cicd.pd.hmq.dev, ...] and it renders through into serve.yaml. Host-header validation passes; the Origin check rejects.

Looking at src/cli/commands/serve.ts:validateWebSocketOrigin:

  • TRUSTED_ORIGINS is a hardcoded set of loopback origins plus https://${bindHost} when TLS is on.
  • trustedHosts is only threaded into the Host-header check further down; it never seeds TRUSTED_ORIGINS.
  • There is no --trusted-origins flag or trusted-origins config key.

Net effect: with the pod bound to 0.0.0.0 behind an ingress, no browser Origin ever matches, so the dashboard is unusable off-loopback even when all other config (auth, TLS, trustedHosts) is correct.

Suggested fix, either or both:

  1. Seed TRUSTED_ORIGINS from trustedHosts (with the same scheme rule already used for bindHost), since these are exactly the hostnames the operator has already declared safe to reach the server by.
  2. Add a trusted-origins config key / --trusted-origins flag for the case where the operator wants Origin to be a strictly narrower set than Host.

Reproduction:

swamp serve --host 0.0.0.0 --port 9090 \
  --cert-file … --key-file … --auth-mode oauth --dashboard
# (with an ingress terminating TLS at https://swamp.example.com and forwarding to the pod)
# Browser opens https://swamp.example.com/dashboard, SPA loads, WS handshake dies.

Version: 20260826.004253.0-sha.b64b034d (first tag that ships the dashboard dist).

Automoved by swampadmin from https://github.com/swamp-club/swamp/issues/2260

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 2 MOREREVIEW+ 7 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

8/26/2026, 3:56:33 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack728/26/2026, 2:53:42 PM

Sign in to post a ripple.