ClintchizandClaude Opus 5 e66d2425aa fix(gateway): allow HMR sockets on every configured domain ...

The WebSocket origin check compared the browser's Origin host, which
carries the port, against configured domains, which do not. publicOrigin
only ever matches domains[0], so every other domain fell through to that
comparison and was denied purely on the port: web.localhost:3000 never
matched web.localhost.

The result was a 403 on the HMR upgrade and a client reconnecting
forever, while the page itself loaded fine because HTTP routing resolves
the Host separately.

Compares hostnames now. Unrelated and lookalike-suffix origins are still
denied, and both cases are covered by tests.

Verified through a real gateway: the HMR socket opens on both localhost
and web.localhost, and a live edit reaches the browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-18 19:53:27 +05:30

..

actions-runtime.test.ts

refactor: migrate legacy wire namespace to wrn

2026-08-12 18:51:15 +05:30

authz-boot.test.ts

feat(dev-server): load the authz catalog at boot

2026-08-04 22:03:28 +05:30

authz-prod.test.ts

fix(dev-server): don't clobber a caller-set authz catalog; drop dead RuntimeDeps.authz

2026-08-05 02:10:00 +05:30

authz-startserver.test.ts

fix(dev): consolidate generated cache directories

2026-08-12 22:25:12 +05:30

browser-bundle-0.8.3.test.ts

refactor: migrate legacy wire namespace to wrn

2026-08-12 18:51:15 +05:30

cache-ignore-config.test.ts

fix(dev): consolidate generated cache directories

2026-08-12 22:25:12 +05:30

cache-runtime.test.ts

release: WRNexusJS 0.8.0

2026-08-02 23:18:51 +05:30

component-composition-runtime.test.ts

fix layout SSR translations and remediation follow-ups

2026-08-09 18:49:16 +05:30

component-name.test.ts

release: WRNexusJS 0.5.10

2026-07-30 13:36:29 +05:30

gateway-basic-auth.test.ts

fix(security): close SSRF, credential-leak, and auth bypass findings in 0.8.4

2026-08-04 15:57:22 +05:30

gateway-ws-origin.test.ts

fix(gateway): allow HMR sockets on every configured domain

2026-08-18 19:53:27 +05:30

gateway.test.ts

feat(gateway): forward application identity on WebSocket upgrades

2026-08-18 19:16:54 +05:30

hmr-client-syntax.test.ts

fix(dev): repair the HMR client and keep islands alive across updates

2026-08-18 18:15:21 +05:30

hmr.test.ts

fix(dev): repair the HMR client and keep islands alive across updates

2026-08-18 18:15:21 +05:30

import-modes-v060.test.ts

fix: ignore WRN component examples in import validation

2026-08-12 19:13:28 +05:30

island-e2e.test.ts

feat(islands): wire islands end to end

2026-08-18 16:16:03 +05:30

island-scripts.test.ts

feat(islands): wire islands end to end

2026-08-18 16:16:03 +05:30

load-runtime.test.ts

release: WRNexusJS 0.8.0

2026-08-02 23:18:51 +05:30

native-runtime.test.ts

first commit

2026-07-12 15:55:18 +05:30

node-adapter.test.ts

first commit

2026-07-12 15:55:18 +05:30

not-found-runtime.test.ts

feat(islands): wire islands end to end

2026-08-18 16:16:03 +05:30

observability-runtime.test.ts

feat(rpc): transport, server, client, http, mounting, docs (Tasks 5-11)

2026-08-05 19:38:04 +05:30

partial-build.test.ts

release: WRNexusJS 0.8.0

2026-08-02 23:18:51 +05:30

performance-runtime.test.ts

fix: update PWA workers without reloading pages

2026-08-03 00:54:29 +05:30

pipeline.test.ts

refactor: migrate legacy wire namespace to wrn

2026-08-12 18:51:15 +05:30

plugin-assets.test.ts

release: WRNexusJS 0.7.0

2026-08-01 10:04:42 +05:30

plugin-config-lifecycle.test.ts

release: WRNexusJS 0.5.0

2026-07-29 12:51:10 +05:30

plugin-render-runtime.test.ts

release: WRNexusJS 0.8.0

2026-08-02 23:18:51 +05:30

production-hmr.test.ts

release: WRNexusJS 0.8.3

2026-08-03 19:47:30 +05:30

props.test.ts

release: WRNexusJS 0.3.5

2026-07-24 12:46:44 +05:30

public.test.ts

perf: optimize production assets and proxy-aware URLs

2026-07-12 17:27:02 +05:30

rpc-csrf.test.ts

fix: reject RPC requests without CSRF tokens

2026-08-12 19:49:58 +05:30

rpc-endpoint.test.ts

feat(rpc): add the caller-side example and close remaining coverage gaps

2026-08-05 20:21:41 +05:30

rpc-services-loading.test.ts

fix(rpc): close the four final-review blockers on inter-app RPC

2026-08-05 20:36:31 +05:30

theme-accent-runtime.test.ts

refactor: migrate legacy wire namespace to wrn

2026-08-12 18:51:15 +05:30

ui-css-hmr.test.ts

refactor: migrate legacy wire namespace to wrn

2026-08-12 18:51:15 +05:30