Relax Origins

[mindovermiles262]

I'm trying to automate the deployment of a reverse proxy to log into cockpit-ws. I want to allow all subdomains from my TLD (i.e. abc0123.mydomain.com). In the cockpit.conf manual it states that Protocol, Domain, and Port are required and are, indeed, required. Is there any way to relax these origin rules or add a wildcard into the allowed Origins?

To test this out I have cockpit running on http://localhost:9090 with an nginx proxy running on http://mydomain.com:8081

# cockpit.conf
[WebService]
Origins = http://mydomain.com:8081 ws://mydomain.com:8081
AllowUnencrypted = true

• Note for above - I want to change the Origins to allow *.mydomain.com for both https and wss

nginx.conf

server {
        listen 8081;
        server_name mydomain.com;

        location / {
                proxy_pass https://127.0.0.1:9090;
                proxy_set_header Host $host;

                proxy_http_version 1.1;
                proxy_buffering off;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                gzip off;
    }
}

Cockpit socket is started via systemd with no changes to the service file.

Is there a way to relax these origin rules to allow *.mydomain.com as valid Origins?

[mindovermiles262]

I've also tried to mock the Host and Origin headers in my nginx reverse proxy:

...
        location / {
                proxy_pass http://127.0.0.1:9090;
                proxy_set_header Host http://localhost:8081;
                proxy_set_header Origin http://localhost:8081;
...

but get the following errors in my cockpit-ws process:

WebSocket-Message: 20:41:31.182: received request from bad Origin: http://localhost:8081
WebSocket-Message: 20:41:31.183: Received invalid handshake request from the client

with a "Connection Failed" error in my web browser, instructing me to look for errors in journalctl (There are no errors, just service start/stop logs)

[martinpitt]

Let's treat this as a bug report: #21738