feat: add wildcard "*" to allow all hosts to connect via websocket - #2280
Merged
DavidsonGomes merged 1 commit intoDec 5, 2025
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
Reviewer's guide (collapsed on small PRs)
Reviewer's GuideAdds support for a wildcard "*" value in the WEBSOCKET_ALLOWED_HOSTS configuration to bypass WebSocket IP restriction checks while preserving existing explicit host validation behavior. File-Level Changes
Tips and commands Interacting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Prompt for AI AgentsPlease address the comments from this code review:
## Individual Comments
### Comment 1
<location> `src/api/integrations/event/websocket/websocket.controller.ts:36-37` </location>
<code_context>
const websocketConfig = configService.get<Websocket>('WEBSOCKET');
const allowedHosts = websocketConfig.ALLOWED_HOSTS || '127.0.0.1,::1,::ffff:127.0.0.1';
- const isAllowedHost = allowedHosts
+ const allowAllHosts = allowedHosts.trim() === '*';
+ const isAllowedHost = allowAllHosts || allowedHosts
.split(',')
.map((h) => h.trim())
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Consider supporting '*' alongside other entries in ALLOWED_HOSTS, not only when it's the sole value.
Currently `allowAllHosts` is only true when `allowedHosts.trim() === '*'`. With a value like `"*,10.0.0.1"`, `*` will never match `remoteAddress` and the code will not allow all hosts as many would expect. To treat `*` as a wildcard even when combined with other entries, derive `allowAllHosts` from the split tokens, e.g.:
```ts
const tokens = allowedHosts.split(',').map(h => h.trim());
const allowAllHosts = tokens.includes('*');
const isAllowedHost = allowAllHosts || tokens.includes(remoteAddress);
```
(or equivalent), reusing `tokens` for the includes check.
</issue_to_address>Sourcery is free for open source - if you like our reviews please consider sharing them ✨ Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Sorry, something went wrong.
Comment thread
src/api/integrations/event/websocket/websocket.controller.ts
Vitordotpy
approved these changes
Dec 4, 2025
Copy link
Copy Markdown
Member
|
Please, fix the lint with npm run lint |
Sorry, something went wrong.
DavidsonGomes
merged commit 38be0b4
into
evolution-foundation:develop
Dec 5, 2025
4 of 5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
Adds support for using * in WEBSOCKET_ALLOWED_HOSTS env variable to allow any host to bypass the API’s WebSocket IP-restriction checks. Useful for local/Docker setups where container IPs change. Normal host whitelisting behavior remains unchanged when * is not used
🧪 Type of Change
🧪 Testing
✅ Checklist
📝 Additional Notes
Intended only for development scenarios. Production should continue using explicit whitelists as introduced in the original security enhancement PR #1929
Summary by Sourcery
New Features: