From 0bace1ce8826a9a1be4003681fab5138f174c275 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 8 Nov 2026 11:53:04 +0100 Subject: dev: add a no-nginx browser stack script scripts/dev-web.sh builds the server, gateway and app, creates target/dev-web/identity, and runs the game server, webd and a loopback static server. The app accepts a ?ws= override only on loopback so the page and gateway can sit on different local ports; production stays same-origin at /ws. --- web/play/src/main.ts | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'web/play/src') diff --git a/web/play/src/main.ts b/web/play/src/main.ts index 15eecf5..690d827 100644 --- a/web/play/src/main.ts +++ b/web/play/src/main.ts @@ -63,7 +63,20 @@ const descriptions: Record = { const basePath = location.pathname.includes("/play/") ? location.pathname.slice(0, location.pathname.indexOf("/play/")) : ""; -const wsUrl = `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}${basePath}/ws`; +const defaultWsUrl = `${location.protocol === "https:" ? "wss" : "ws"}://${location.host}${basePath}/ws`; + +// A local-only escape hatch for `scripts/dev-web.sh`, which serves the static +// page and the gateway on different loopback ports. Never honour ?ws= on a +// real host: it would let a crafted link send a password hash elsewhere. +const devWs = new URLSearchParams(location.search).get("ws"); +const loopback = + location.hostname === "127.0.0.1" || + location.hostname === "localhost" || + location.hostname === "::1"; +const wsUrl = + devWs && loopback && (devWs.startsWith("ws://") || devWs.startsWith("wss://")) + ? devWs + : defaultWsUrl; const gateway = new Gateway(wsUrl, { onHello(hello) { -- cgit v1.2.3