[agentHits]

What is this PR about?

WebSocket upgrades (/terminal, /docker-container-terminal, /docker-container-logs, /listen-docker-stats-monitoring, /listen-deployment, /drawer-logs) were authenticated only by the session cookie and never looked at Origin. The cookie is SameSite=Lax, so a browser attaches it to a WebSocket handshake started by a page on a sibling subdomain of the panel domain. An app deployed on such a subdomain could open a host terminal, a container shell or a log stream with the visiting user's session.

This PR adds one shared check, apps/dokploy/server/wss/origin.ts, and wires it into every panel WebSocketServer via verifyClient. It runs inside handleUpgrade, before the connection event, so a rejected handshake gets an HTTP 403 with no session lookup and no side effects.

The upgrade is accepted when:

• Origin is absent. Browsers always send it on WebSocket handshakes. The only clients that leave it out are non-browser clients (x-api-key scripts, Node ws, wscat), and those cannot ride a browser cookie anyway. Requiring Origin would break those API-key clients.
• Origin matches the request Host, comparing host:port without the scheme (the panel often sits behind TLS-terminating Traefik with passHostHeader: true).
• Origin is exactly one of better-auth's trustedOrigins for regular auth requests (resolveTrustedOriginsForAuthRequest(): https://<panel host>, http://<server IP>:3000, dev origins). This list is only read when the Host check fails.

null, empty and non-http(s) origins are rejected, and so is the same IP on another port. The Next.js HMR early return is unchanged.

Checks

• CI=true bunx vitest run --config __test__/vitest.config.ts __test__/wss/origin.test.ts: 29 passed. The file covers same host, configured trusted origin, sibling subdomain, foreign origin, another port, opaque origins, absent origin and fail-closed behavior. It also has handler-level tests for all six servers: a sibling origin gets a 403 and validateRequest is never called, and the panel origin still reaches the session check.
• Against the old handlers from the base branch, the 6 handler-level rejection tests fail because the upgrade is accepted.
• __test__/wss + cluster/cluster-router-security + domains/domain-validation: 12 files, 127 passed.
• bun run typecheck: exit 0.
• bunx biome check on changed files: 0 errors. The 5 useOptionalChain warnings were already there and are not on changed lines.

Rollout notes

• No migration or config change.
• If a proxy in front of the panel rewrites Host (for example a tunnel forwarding to localhost:3000), browser WebSockets will now get 403 unless the panel domain is set as the web server host in settings, which puts it in trusted origins.
• Cookie attributes are unchanged in this PR.

🤖 Generated with Claude Code