Local-Cursor/internal/localaccess/origin.go

// Package localaccess prevents unrelated browser pages from driving local RPCs.
package localaccess

import (
	"net"
	"net/http"
	"net/url"
	"strings"
)

func AllowedOrigin(raw string) bool {
	if raw == "" {
		return true
	} // Native Cursor/CLI requests do not send Origin.
	u, err := url.Parse(raw)
	if err != nil || u.User != nil || u.Hostname() == "" {
		return false
	}
	switch strings.ToLower(u.Scheme) {
	case "vscode-file", "vscode-webview", "wails":
		return true
	case "http", "https":
	default:
		return false
	}
	host := strings.ToLower(u.Hostname())
	if host == "localhost" || host == "wails.localhost" || net.ParseIP(host).IsLoopback() {
		return true
	}
	for _, domain := range []string{"cursor.sh", "cursor.com"} {
		if host == domain || strings.HasSuffix(host, "."+domain) {
			return u.Scheme == "https"
		}
	}
	return false
}

func Wrap(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !AllowedOrigin(r.Header.Get("Origin")) {
			http.Error(w, "untrusted browser origin", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}