fix(ffi): allow Android's virtual-origin pages through gateway CORS - #63
Draft
meinharrd wants to merge 1 commit into
Draft
fix(ffi): allow Android's virtual-origin pages through gateway CORS#63meinharrd wants to merge 1 commit into
meinharrd wants to merge 1 commit into
Conversation
The FFI gateway pinned cors-allowed-origins to the literal 'null',
which matches iOS (WKWebView custom schemes serialize the page origin
as the opaque null) and desktop Electron, but not Freedom Android:
since the virtual-origin switch its WebView serves every dweb content
root from its own synthetic https origin under the pinned
freedom.baby suffixes, so requests arrive with a real Origin header
the exact-match policy can never enumerate. Result: reads work (the
app's interceptor proxies them) but direct browser-fetch writes to the
node API - the sanctioned upload path, since intercepted origins are
GET/HEAD-only - are blocked on the response leg.
CorsConfig learns wildcard-subdomain entries (scheme://*.host): any
direct-or-deeper subdomain of the suffix matches, the apex does not,
and lookalike hosts, other schemes, and ports are rejected. Bee-shape
configs ('*', 'null', exact origins) parse unchanged. The FFI gateway
now allows 'null' plus https://*.{bzz,ipfs,ipns,ens}.freedom.baby.
Deliberately not '*': the API is loopback-only, but CORS is exactly
what keeps drive-by pages in other browsers on the same device from
reading /wallet and friends.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream fix for the write-path gap documented in freedom-browser-android's
docs/virtual-origins-hardening.md(solardev-xyz/freedom-browser-android#14).Problem
The FFI gateway pins
CorsConfig::new(["null"])— right for iOS (WKWebView custom-scheme pages have an opaquenullorigin) and desktop, wrong for Android since the virtual-origin switch (freedom-browser-android v0.4.1): pages there live onhttps://<label>.bzz.freedom.baby-style origins and send a realOrigin:header that an exact-match policy can never enumerate (one origin per content root). Reads are unaffected (the app's interceptor proxies them), but direct browser-fetchwrites to the node API — the sanctioned upload path, since intercepted origins are GET/HEAD-only — get their responses CORS-blocked.Change
CorsConfigaccepts wildcard-subdomain entries (scheme://*.host): any direct-or-deeper subdomain matches (encrypted Swarm refs use two labels), the apex itself doesn't, and lookalike hosts (x.bzz.freedom.baby.evil.example), other schemes, and ports are rejected. Existing bee-shaped configs (*/null/ exact) parse unchanged.null+https://*.{bzz,ipfs,ipns,ens}.freedom.baby(suffixes pinned in the Android app'sVirtualOrigin.kt/ PSL submission).Deliberately not
*: the API is loopback-only, but CORS is precisely what keeps drive-by pages in other browsers on the same device from reading/walletand friends.Verification
All four CI gates green locally:
cargo fmt --check,cargo clippy --workspace --all-targets -- -D warnings,cargo clippy -p ant-ffi --features jni --all-targets -- -D warnings,cargo test --workspace --lib(173 passed). New unit tests cover match/apex/lookalike/scheme/port cases.No version bump per AGENTS.md (not a deployment). After merge: tag an FFI release and bump
FFI_REFin freedom-browser-android'srelease.yml+ rebuild the vendored.soto actually unblock Android uploads.