search

scottlamb / moonfire-nvr

Moonfire NVR, a security camera network video recorder
Other
1.19k stars 138 forks source link

live stream fails with `ws close: 1006` on URLs with port numbers #219

Closed scottlamb closed 2 years ago

scottlamb commented 2 years ago

As mentioned in https://github.com/scottlamb/moonfire-nvr/issues/218#issuecomment-1098689618, there's a problem with my 0.7.3 security fix (changelog entry, commit). If the browser URL has a port number (including the out-of-the-box instructions to use port 8080), the live stream will never authenticate properly. Rather than the server accepting the websocket upgrade, it will send back a HTTP 403 with a body like this:

Permission denied: cross-origin request forbidden (request host "slamb-workstation:8080", origin host "slamb-workstation")

...which the browser UI won't show. It'll just give the classic ws close: 1006 error.