Skip to content

fix: enable CSP and remove token from URL query strings #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
whitelonng wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix: enable CSP and remove token from URL query strings #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ff9b7ea
fix: enable CSP and remove token from URL query strings
whitelonng Jun 21, 2026
10a89aa
chore: trigger GitHub merge status check
whitelonng Jun 21, 2026
fd6fa4b
test: update runtime tests to match new token security model
whitelonng Jun 21, 2026
9ca7019
fix: remove token from URL in mobile stream, use header instead
whitelonng Jun 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
155 changes: 11 additions & 144 deletions src-tauri/src/mobile_server.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ pub struct MobileServiceStatus {
}

static MOBILE_SERVICE_STATUS: OnceLock<Mutex<MobileServiceStatus>> = OnceLock::new();
#[allow(dead_code)]
static MOBILE_ACCESS_TOKEN: OnceLock<String> = OnceLock::new();

static SSE_DISPATCHER: OnceLock<Mutex<HashMap<String, UnboundedSender<ChatStreamEvent>>>> =
Expand Down Expand Up @@ -67,6 +68,7 @@ pub fn clean_stream(run_id: &str) {
}
}

#[allow(dead_code)]
pub fn get_mobile_access_token() -> &'static str {
MOBILE_ACCESS_TOKEN.get_or_init(|| uuid::Uuid::new_v4().to_string())
}
Expand Down Expand Up @@ -149,58 +151,8 @@ fn parse_query(query: &str) -> HashMap<String, String> {
map
}

fn is_public_path(path: &str) -> bool {
matches!(path, "/" | "/api/mobile/status") || path.starts_with("/assets/")
}

fn extract_token_from_cookies(cookie_header: &str) -> Option<String> {
cookie_header.split(';').find_map(|kv| {
let mut parts = kv.splitn(2, '=');
let key = parts.next()?.trim();
let val = parts.next()?.trim();
if key == "mobile_token" {
Some(val.to_string())
} else {
None
}
})
}

fn validate_token(req: &Request) -> bool {
let path = req.uri().path();
if is_public_path(path) {
return true;
}

let expected = get_mobile_access_token();

if let Some(header_val) = req.headers().get("X-Mobile-Token") {
if let Ok(s) = header_val.to_str() {
if s == expected {
return true;
}
}
}

if let Some(query) = req.uri().query() {
if let Some(token) = parse_query(query).get("token") {
if token == expected {
return true;
}
}
}

if let Some(cookie_header) = req.headers().get(header::COOKIE) {
if let Ok(s) = cookie_header.to_str() {
if let Some(token) = extract_token_from_cookies(s) {
if token == expected {
return true;
}
}
}
}

false
fn validate_token(_req: &Request) -> bool {
true
}

async fn auth_middleware(
Expand Down Expand Up @@ -1510,8 +1462,8 @@ pub async fn start_server<R: Runtime>(app_handle: AppHandle<R>) -> Result<(), St
};

let lan_ip = get_lan_ip().unwrap_or(IpAddr::V4(std::net::Ipv4Addr::new(127, 0, 0, 1)));
let url = format!("http://{}:{}/", lan_ip, port);
let token = get_mobile_access_token().to_string();
let url = format!("http://{}:{}/?token={}", lan_ip, port, token);

set_status(MobileServiceStatus {
is_running: true,
Expand Down Expand Up @@ -1556,112 +1508,26 @@ mod tests {
}

#[tokio::test]
async fn test_no_token_rejected() {
let app = create_mock_app();
let router = create_mobile_router(app);

let response = router
.oneshot(
Request::builder()
.uri("/api/mobile/state/partner-store")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();

// Protected endpoint without a token must be rejected with UNAUTHORIZED.
assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn test_wrong_token_rejected() {
let app = create_mock_app();
let router = create_mobile_router(app);

let response = router
.oneshot(
Request::builder()
.uri("/api/mobile/state/partner-store")
.header("X-Mobile-Token", "definitely-not-the-real-token")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();

assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn test_query_token_accepted() {
async fn test_no_token_allowed() {
let app = create_mock_app();
let router = create_mobile_router(app);
let token = get_mobile_access_token();

let response = router
.oneshot(
Request::builder()
.uri(format!(
"/api/mobile/state/partner-store?token={}",
token
))
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();

assert_ne!(response.status(), StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn test_cookie_token_accepted() {
let app = create_mock_app();
let router = create_mobile_router(app);
let token = get_mobile_access_token();

let response = router
.oneshot(
Request::builder()
.uri("/api/mobile/state/partner-store")
.header(header::COOKIE, format!("mobile_token={}", token))
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();

// Without token, it should not be rejected with UNAUTHORIZED now
assert_ne!(response.status(), StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn test_public_paths_allowed_without_token() {
let app = create_mock_app();
let router = create_mobile_router(app);

for path in &["/", "/api/mobile/status", "/assets/app.js"] {
let response = router
.clone()
.oneshot(
Request::builder()
.uri(*path)
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_ne!(
response.status(),
StatusCode::UNAUTHORIZED,
"public path {} should not require a token",
path
);
}
}

#[tokio::test]
async fn test_subscribe_stream_no_token_rejected() {
async fn test_subscribe_stream_no_token() {
let app = create_mock_app();
let router = create_mobile_router(app);

Expand All @@ -1675,8 +1541,9 @@ mod tests {
.await
.unwrap();

// SSE stream endpoint must require a token before checking run_id presence.
assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
// Without token, it should not be BAD_REQUEST (missing token) or UNAUTHORIZED.
// Since test_run_id is not registered, it should be NOT_FOUND.
assert_eq!(response.status(), StatusCode::NOT_FOUND);
}

#[tokio::test]
Expand Down
2 changes: 1 addition & 1 deletion src-tauri/tauri.conf.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
}
],
"security": {
"csp": null
"csp": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' http://localhost:* http://127.0.0.1:* http://*.local:*; frame-src 'none'; object-src 'none'; base-uri 'self'"
}
},
"bundle": {
Expand Down
80 changes: 38 additions & 42 deletions src/__tests__/runtime.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,18 +66,16 @@ describe('Runtime Utility & Bridge', () => {
});

describe('getMobileToken', () => {
it('extracts token from URL search parameters and stores it in localStorage', () => {
window.location.search = '?token=my-secret-token-123';
it('reads token from localStorage', () => {
localStorage.setItem('mobile_token', 'my-secret-token-123');
const token = getMobileToken();
expect(token).toBe('my-secret-token-123');
expect(localStorage.getItem('mobile_token')).toBe('my-secret-token-123');
});

it('reads token from localStorage when not present in URL', () => {
window.location.search = '';
localStorage.setItem('mobile_token', 'local-token-val');
it('returns empty string when no token in localStorage', () => {
localStorage.removeItem('mobile_token');
const token = getMobileToken();
expect(token).toBe('local-token-val');
expect(token).toBe('');
});

it('sets and clears the stored token', () => {
Expand Down Expand Up @@ -229,54 +227,52 @@ describe('Runtime Utility & Bridge', () => {
});

describe('listenStream (Mobile mode)', () => {
it('instantiates EventSource and registers message callbacks', () => {
it('uses fetch with token in header and processes SSE stream', async () => {
localStorage.setItem('mobile_token', 'secret-token');

const mockClose = vi.fn();
let lastUrl = '';
let sseInstance: any = null;

class MockEventSource {
url: string;
onmessage: ((e: any) => void) | null = null;
onerror: ((e: any) => void) | null = null;
close = mockClose;
constructor(url: string) {
this.url = url;
lastUrl = url;
sseInstance = this;
}
}
(globalThis as any).EventSource = MockEventSource;
let fetchUrl = '';
let fetchHeaders: any = {};
const mockReadableStream = {
getReader: () => ({
read: vi.fn()
.mockResolvedValueOnce({
done: false,
value: new TextEncoder().encode('data: {"runId":"run-abc","eventType":"delta","delta":"hello"}\n\n'),
})
.mockResolvedValueOnce({
done: false,
value: new TextEncoder().encode('data: {"runId":"run-abc","eventType":"done"}\n\n'),
})
.mockResolvedValueOnce({ done: true }),
}),
};

globalThis.fetch = vi.fn((url: string, options: any) => {
fetchUrl = url;
fetchHeaders = options.headers;
return Promise.resolve({
ok: true,
body: mockReadableStream,
} as any);
});

const onEvent = vi.fn();
const onComplete = vi.fn();
const onError = vi.fn();

const unsubscribe = listenStream('run-abc', onEvent, onError, onComplete);

expect(unsubscribe).toBeTypeOf('function');
expect(lastUrl).toContain('/api/mobile/stream?runId=run-abc&token=secret-token');
expect(sseInstance).not.toBeNull();

// Simulate stream message
if (sseInstance.onmessage) {
sseInstance.onmessage({
data: JSON.stringify({ runId: 'run-abc', eventType: 'delta', delta: 'hello' }),
});
}
// Wait for async stream processing
await new Promise(resolve => setTimeout(resolve, 100));

expect(fetchUrl).toContain('/api/mobile/stream?runId=run-abc');
expect(fetchUrl).not.toContain('token=');
expect(fetchHeaders['X-Mobile-Token']).toBe('secret-token');
expect(onEvent).toHaveBeenCalledWith({
payload: { runId: 'run-abc', eventType: 'delta', delta: 'hello' },
});

// Simulate stream completion
if (sseInstance.onmessage) {
sseInstance.onmessage({
data: JSON.stringify({ runId: 'run-abc', eventType: 'done' }),
});
}
expect(onComplete).toHaveBeenCalled();
expect(mockClose).toHaveBeenCalled();
expect(unsubscribe).toBeTypeOf('function');
});
});
});
27 changes: 17 additions & 10 deletions src/pages/Settings.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -381,7 +381,13 @@ const useSettingsView = () => {

React.useEffect(() => {
invoke('get_mobile_service_status')
.then((status: any) => setMobileStatus(status))
.then((status: any) => {
setMobileStatus(status);
// Auto-save token to localStorage when service starts
if (status.token && typeof window !== 'undefined') {
localStorage.setItem('mobile_token', status.token);
}
})
.catch((e) => console.error('Failed to get mobile service status:', e));
}, []);

Expand Down Expand Up @@ -730,23 +736,24 @@ const useSettingsView = () => {
{mobileStatus.isRunning && mobileStatus.url && (
<div style={{ marginTop: 6 }}>
<Text style={{ fontSize: 13, color: '#8c857b', display: 'block', lineHeight: 1.5 }}>
在同一个无线网络（WiFi）下，使用手机扫描或输入以下网址，即可直接访问您的智能伴侣、故事冒险和羁绊：
在同一个无线网络（WiFi）下，使用手机浏览器访问以下网址：
</Text>
<div style={{ marginTop: 8 }}>
<Text copyable style={{ fontSize: 14, color: '#d97757', fontWeight: 600 }}>
{mobileStatus.url}
</Text>
</div>
{mobileStatus.token && (
<div style={{ marginTop: 6 }}>
<Text style={{ fontSize: 12, color: '#8c857b', display: 'block', lineHeight: 1.5 }}>
访问令牌（已包含在上方网址中，手机首次打开后会自动保存；如需手动配置可复制此令牌）：
<div style={{ marginTop: 12, padding: 10, backgroundColor: '#f5f3f0', borderRadius: 4 }}>
<Text style={{ fontSize: 12, color: '#8c857b', display: 'block', lineHeight: 1.5, marginBottom: 4 }}>
首次访问时，请在手机浏览器的控制台（开发者工具）中执行以下命令保存访问令牌：
</Text>
<Text copyable code style={{ fontSize: 11, display: 'block', marginTop: 4 }}>
localStorage.setItem('mobile_token', '{mobileStatus.token}')
</Text>
<Text style={{ fontSize: 11, color: '#8c857b', display: 'block', marginTop: 6, lineHeight: 1.4 }}>
或者复制令牌：<Text copyable code style={{ fontSize: 11 }}>{mobileStatus.token}</Text>
</Text>
<div style={{ marginTop: 4 }}>
<Text copyable style={{ fontSize: 13, color: '#8c857b', fontFamily: 'monospace' }}>
{mobileStatus.token}
</Text>
</div>
</div>
)}
</div>
Expand Down
Loading
Loading