From f03bf733c87481c80da6f3c56cd6e782bb0b9869 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Wed, 22 Jul 2026 23:54:00 +0000 Subject: [PATCH] origin validation: allowlist the Expo app origin via env APP_ORIGINS now includes EXPO_PUBLIC_CLIENT_ORIGIN when set, so the mobile app's officer:// custom-scheme origin passes origin validation without weakening it for anyone else. The origin (with its embedded token) lives in .env, not the repo. Co-Authored-By: Claude Opus 4.8 --- src/servers/_middlewares/origin-validation.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/servers/_middlewares/origin-validation.ts b/src/servers/_middlewares/origin-validation.ts index 441d87ef..2d11b3b3 100644 --- a/src/servers/_middlewares/origin-validation.ts +++ b/src/servers/_middlewares/origin-validation.ts @@ -1,7 +1,7 @@ import type { MiddlewareHandler } from 'hono'; import * as errors from '../custom-errors'; -const { PUBLIC_BUILD_ENV } = process.env; +const { PUBLIC_BUILD_ENV, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env; const WEB_ORIGINS: Record = { alpha: ['https://alpha.officer.dev'], @@ -13,8 +13,9 @@ const CHROME_EXTENSIONS: string[] = [ ]; const APP_ORIGINS: string[] = [ - // Future: mobile app / webview origins -]; + // Expo mobile app — an officer:// custom-scheme origin (with an embedded token), set via env. + EXPO_PUBLIC_CLIENT_ORIGIN, +].filter((o): o is string => Boolean(o)); export function isOriginAllowed(origin: string | undefined, host?: string): boolean { if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {