Skip to content

Allow filtered loopback browser runtimes - #2308

Merged
chubes4 merged 1 commit into
mainfrom
fix/allow-loopback-browser-runtime
Aug 22, 2026
Merged

Allow filtered loopback browser runtimes#2308
chubes4 merged 1 commit into
mainfrom
fix/allow-loopback-browser-runtime

Conversation

@chubes4

@chubes4 chubes4 commented Aug 22, 2026

Copy link
Copy Markdown
Collaborator

Closes #2307

Summary

  • allow HTTP browser runtime URLs only for loopback hosts
  • admit each exact loopback origin by default while preserving the existing origin filter as final authority
  • retain rejection of public HTTP and unapproved HTTPS runtime origins

Verification

  • npm run build
  • npm run test:php-browser-runtime-url-policy
  • git diff --check

AI assistance

OpenCode using OpenAI gpt-5.6-sol traced the local self-hosted runtime failure, reviewed and completed the URL policy and regression coverage, and ran verification. Chris Huber reviewed and remains responsible for every line.

@chubes4
chubes4 merged commit e6f3779 into main Aug 22, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow explicitly filtered loopback browser runtime URLs

1 participant