Add (optional) Origin header check

config.example.toml

@@ -6,6 +6,10 @@ proxying = false
 # IPs allowed to access the server in proxy mode.
 # 99% of the time this will only be 127.0.0.1
 proxyAllowedIps = ["127.0.0.1"]
+# Whether the Origin header check is enabled.
+origin = false
+# Origins to accept connections from.
+originAllowedDomains = ["computernewb.com"]
 
 [vm]
 qemuArgs = "qemu-system-x86_64"

src/IConfig.ts

@@ -4,6 +4,8 @@ export default interface IConfig {
         port : number;
         proxying : boolean;
         proxyAllowedIps : string[];
+        origin : boolean;
+        originAllowedDomains : string[];
     };
     vm : {
         qemuArgs : string;

src/WSServer.ts

@@ -85,13 +85,35 @@ export default class WSServer {
             socket.write("HTTP/1.1 400 Bad Request\n\n400 Bad Request");
             socket.destroy();
         }
-        if (
+
-            req.headers['sec-websocket-protocol'] !== "guacamole" 
+        if (req.headers['sec-websocket-protocol'] !== "guacamole") {
-            // || req.headers['origin']?.toLocaleLowerCase() !== "https://computernewb.com"
-        ) {
             killConnection();
             return;
         }
+
+        if (this.Config.http.origin) {
+            // If the client is not sending an Origin header, kill the connection.
+            if(!req.headers.origin) {
+                killConnection();
+                return;
+            }
+
+            // Try to parse the Origin header sent by the client, if it fails, kill the connection.
+            var _host;
+            try {
+                _host = new URL(req.headers.origin.toLowerCase()).hostname;
+            } catch {
+                killConnection();
+                return;
+            }
+
+            // If the domain name is not in the list of allowed origins, kill the connection.
+            if(!this.Config.http.originAllowedDomains.includes(_host)) {
+                killConnection();
+                return;
+            }
+        }
+
         if (this.Config.http.proxying) {
             // If the requesting IP isn't allowed to proxy, kill it
             //@ts-ignore