From c309631bc462ad75240f07bf2646a9cd15cea85e Mon Sep 17 00:00:00 2001 From: Priyanshubhartistm Date: Mon, 20 Jul 2026 15:25:53 +0530 Subject: [PATCH] fix(web-app): map ws:// relay URL to http:// for CSP connect-src Signed-off-by: Priyanshubhartistm --- .changeset/fix-csp-ws-http-scheme-mapping.md | 10 ++++++++++ src/factories/web-app-factory.ts | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 .changeset/fix-csp-ws-http-scheme-mapping.md diff --git a/.changeset/fix-csp-ws-http-scheme-mapping.md b/.changeset/fix-csp-ws-http-scheme-mapping.md new file mode 100644 index 00000000..fe29e22f --- /dev/null +++ b/.changeset/fix-csp-ws-http-scheme-mapping.md @@ -0,0 +1,10 @@ +--- +"nostream": patch +--- + +Fix the Content-Security-Policy `connect-src` directive for relays served over plain `ws://`. + +The web app factory derived an HTTP(S) origin from the relay's WebSocket URL but mapped +`ws:` to the invalid scheme `':'`, which the WHATWG URL API silently ignores. As a result the +`connect-src` directive kept a `ws://…` entry instead of the intended `http://…` origin for +local/dev, Tor, or reverse-proxied setups. The `ws:` protocol now correctly maps to `http:`. diff --git a/src/factories/web-app-factory.ts b/src/factories/web-app-factory.ts index 697b262c..408d340b 100644 --- a/src/factories/web-app-factory.ts +++ b/src/factories/web-app-factory.ts @@ -15,7 +15,7 @@ export const createWebApp = (): Express => { const relayUrl = new URL(settings.info.relay_url) const webRelayUrl = new URL(relayUrl.toString()) - webRelayUrl.protocol = relayUrl.protocol === 'wss:' ? 'https:' : ':' + webRelayUrl.protocol = relayUrl.protocol === 'wss:' ? 'https:' : 'http:' const directives = { 'img-src': ["'self'", 'data:', 'https://cdn.zebedee.io/an/nostr/'],