fix: old client compatibility

packages/backend/server/src/base/cors.ts

@@ -7,7 +7,12 @@ const MOBILE_CLIENT_ORIGINS = new Set([
   'capacitor://localhost',
   'ionic://localhost',
 ]);
-const DESKTOP_CLIENT_ORIGINS = new Set(['assets://.', 'assets://another-host']);
+const DESKTOP_CLIENT_ORIGINS = new Set([
+  'assets://.',
+  'assets://another-host',
+  // for old versions of client, which use file:// as origin
+  'file://',
+]);
 
 export const CORS_ALLOWED_METHODS = [
   'GET',
@@ -55,6 +60,19 @@ function isDevLoopbackOrigin(origin: string) {
   }
 }
 
+function normalizeCorsOrigin(origin: string) {
+  try {
+    const parsed = new URL(origin);
+    // Some websocket clients send ws:// or wss:// as Origin.
+    if (parsed.protocol === 'ws:' || parsed.protocol === 'wss:') {
+      parsed.protocol = parsed.protocol === 'wss:' ? 'https:' : 'http:';
+    }
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+
 export function buildCorsAllowedOrigins(url: URLHelper) {
   return new Set<string>([
     ...url.allowedOrigins,
@@ -75,6 +93,11 @@ export function isCorsOriginAllowed(
     return true;
   }
 
+  const normalizedOrigin = normalizeCorsOrigin(origin);
+  if (normalizedOrigin && allowedOrigins.has(normalizedOrigin)) {
+    return true;
+  }
+
   if ((env.dev || env.testing) && isDevLoopbackOrigin(origin)) {
     return true;
   }

packages/backend/server/src/base/helpers/__tests__/url.spec.ts

@@ -1,6 +1,7 @@
 import ava, { TestFn } from 'ava';
 import Sinon from 'sinon';
 
+import { buildCorsAllowedOrigins, isCorsOriginAllowed } from '../../cors';
 import { ActionForbidden } from '../../error';
 import { URLHelper } from '../url';
 
@@ -193,3 +194,19 @@ test('can get request base url with multiple hosts', t => {
   t.is(url.requestOrigin, 'https://app.affine.local2');
   t.is(url.requestBaseUrl, 'https://app.affine.local2');
 });
+
+test('should allow websocket secure origin by normalizing wss to https', t => {
+  const allowedOrigins = buildCorsAllowedOrigins({
+    allowedOrigins: ['https://app.affine.pro'],
+  } as any);
+
+  t.true(isCorsOriginAllowed('wss://app.affine.pro', allowedOrigins));
+});
+
+test('should allow desktop file origin', t => {
+  const allowedOrigins = buildCorsAllowedOrigins({
+    allowedOrigins: [],
+  } as any);
+
+  t.true(isCorsOriginAllowed('file://', allowedOrigins));
+});