Package com.tnsai.server.security

Class OriginPolicy

java.lang.Object
com.tnsai.server.security.OriginPolicy
public final class OriginPolicy extends Object
Origin allowlist for the WebSocket upgrade (TNS-302).

Browsers attach an Origin: <scheme://host[:port]> header on every cross-origin WS handshake. This handler runs at wsBeforeUpgrade time and rejects 403 when the supplied Origin is not on the allowlist.

The default allowlist accepts:

  • Missing or null Origin (native non-browser clients).
  • http://localhost:* and http://127.0.0.1:* (and the https:// variants).
Additional explicit origins can be supplied via with(String...) or the TNSAI_ALLOWED_ORIGINS environment variable (comma-separated).

  • Field Details

  • Method Details

    • loopback

      public static OriginPolicy loopback()
      Default policy: accept missing Origin + any loopback host on any port.

    • with

      public static OriginPolicy with(String... origins)
      Policy that accepts loopback plus the explicit origin list.

    • strict

      public static OriginPolicy strict(String... origins)
      Strict policy: only the explicit origins, no loopback wildcarding.

    • fromEnv

      public static OriginPolicy fromEnv()
      Reads TNSAI_ALLOWED_ORIGINS (comma-separated) and combines it with the loopback default. Empty / unset env yields loopback().

    • explicitOrigins

      public List<String> explicitOrigins()

    • allowLoopback

      public boolean allowLoopback()

    • isAllowed

      public boolean isAllowed(String origin)
      Returns true when origin (HTTP Origin header value) is allowed under this policy. null or blank is allowed because non-browser clients omit the header.

    • before

      public void before(io.javalin.http.Context ctx)
      wsBeforeUpgrade handler.