From 4f043f9576bbda13b16ae47981fd77151a199fad Mon Sep 17 00:00:00 2001 From: Felipe Augusto Rieck Date: Mon, 4 Aug 2025 16:34:20 -0300 Subject: [PATCH] Securing websockets --- src/api/integrations/event/websocket/websocket.controller.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/api/integrations/event/websocket/websocket.controller.ts b/src/api/integrations/event/websocket/websocket.controller.ts index a1cef2db..c0d3e5de 100644 --- a/src/api/integrations/event/websocket/websocket.controller.ts +++ b/src/api/integrations/event/websocket/websocket.controller.ts @@ -28,10 +28,11 @@ export class WebsocketController extends EventController implements EventControl allowRequest: async (req, callback) => { try { const url = new URL(req.url || '', 'http://localhost'); + const isInternalConnection = req.socket.remoteAddress === '127.0.0.1' || req.socket.remoteAddress === '::1'; const params = new URLSearchParams(url.search); // Permite conexões internas do Socket.IO (EIO=4 é o Engine.IO v4) - if (params.has('EIO')) { + if (params.has('EIO') && isInternalConnection) { return callback(null, true); }