1 files changed, 14 insertions, 1 deletions

diff --git a/web/play/src/main.ts b/web/play/src/main.ts
index 15eecf5..690d827 100644
--- a/web/play/src/main.ts
+++ b/web/play/src/main.ts
@@ -63,7 +63,20 @@ const descriptions: Record<string, string> = {
 const basePath = location.pathname.includes("/play/")
   ? location.pathname.slice(0, location.pathname.indexOf("/play/"))
   : "";
-const wsUrl = `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}${basePath}/ws`;
+const defaultWsUrl = `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}${basePath}/ws`;
+
+// A local-only escape hatch for `scripts/dev-web.sh`, which serves the static
+// page and the gateway on different loopback ports. Never honour ?ws= on a
+// real host: it would let a crafted link send a password hash elsewhere.
+const devWs = new URLSearchParams(location.search).get("ws");
+const loopback =
+  location.hostname === "127.0.0.1" ||
+  location.hostname === "localhost" ||
+  location.hostname === "::1";
+const wsUrl =
+  devWs && loopback && (devWs.startsWith("ws://") || devWs.startsWith("wss://"))
+    ? devWs
+    : defaultWsUrl;
 
 const gateway = new Gateway(wsUrl, {
   onHello(hello) {