From 3cf6413fcc6b6ac990c224e10542a6414d57f09c Mon Sep 17 00:00:00 2001 From: Gulum Date: Fri, 5 Jun 2026 23:46:59 +0200 Subject: [PATCH] ARCH-2b: permissive LAN CORS + bind API on 0.0.0.0, drop HTTPS redirect MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - AddCors lan policy (AllowAnyOrigin/Header/Method) — trusted home LAN, no auth - Widen ASPNETCORE_URLS host localhost/127.0.0.1 -> 0.0.0.0 (keep Aspire-assigned port) - Remove dev HTTPS redirection so phones reach the API over plain HTTP Co-Authored-By: Claude Opus 4.8 (1M context) --- GerbilManagerWebAPI/Program.cs | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/GerbilManagerWebAPI/Program.cs b/GerbilManagerWebAPI/Program.cs index 2073496..a0c5594 100644 --- a/GerbilManagerWebAPI/Program.cs +++ b/GerbilManagerWebAPI/Program.cs @@ -5,6 +5,18 @@ var builder = WebApplication.CreateBuilder(args); builder.AddServiceDefaults(); +// LAN reachability: bind on all interfaces so devices on the home network (the +// SPA on a phone/laptop) can reach the API. We keep whatever port Aspire / +// launchSettings assigned and only widen the host from localhost to 0.0.0.0. +var aspnetUrls = Environment.GetEnvironmentVariable("ASPNETCORE_URLS"); +if (!string.IsNullOrWhiteSpace(aspnetUrls)) +{ + var lanUrls = string.Join(';', aspnetUrls + .Split(';', StringSplitOptions.RemoveEmptyEntries) + .Select(u => u.Replace("localhost", "0.0.0.0").Replace("127.0.0.1", "0.0.0.0"))); + builder.WebHost.UseUrls(lanUrls); +} + // Add services to the container. builder.Services.AddControllers(); @@ -14,6 +26,12 @@ builder.Services.AddSwaggerGen(); builder.AddNpgsqlDbContext("gerbilmanager"); builder.Services.AddScoped(); +// Permissive CORS for the trusted home LAN (no auth — see hive scope rule). +// The SPA calls the API cross-origin from other devices on the network. +const string LanCorsPolicy = "lan"; +builder.Services.AddCors(options => options.AddPolicy(LanCorsPolicy, policy => + policy.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod())); + var app = builder.Build(); app.MapDefaultEndpoints(); @@ -29,10 +47,10 @@ if (app.Environment.IsDevelopment()) scope.ServiceProvider.GetRequiredService().Database.Migrate(); } -if (app.Environment.IsDevelopment()) -{ - app.UseHttpsRedirection(); -} +// No HTTPS redirection: the LAN clients (phone) talk plain HTTP to avoid +// dev-certificate trust issues on the device. + +app.UseCors(LanCorsPolicy); app.UseAuthorization();