{"record":{"id":"484c7e26b2d2c9fc","repo":"diegosouzapw/OmniRoute","slug":"forbidden-origin","errorCode":"FORBIDDEN_ORIGIN","errorMessage":"Origin not allowed","messagePattern":"Origin not allowed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/server/ws/liveServer.ts","lineNumber":517,"sourceCode":"        ) {\n          sendTo(ws, { type: \"error\", code: \"RATE_LIMITED\", message: \"Too many early messages\" });\n          ws.close(4008, \"Too many early messages\");\n          return;\n        }\n        pendingMessages.push(raw);\n        return;\n      }\n      handleMessage(activeClientId, raw);\n    });\n\n    // Origin check — browsers always send Origin on the WS upgrade; reject\n    // unknown origins to stop drive-by cross-origin WebSocket from a victim\n    // page. Non-browser clients (CLI / MCP) omit Origin and are accepted\n    // only when bound to loopback (see isOriginAllowed).\n    const origin = request.headers[\"origin\"];\n    const originStr = Array.isArray(origin) ? origin[0] : origin;\n    if (!isOriginAllowed(originStr)) {\n      sendTo(ws, { type: \"error\", code: \"FORBIDDEN_ORIGIN\", message: \"Origin not allowed\" });\n      ws.close(4003, \"Forbidden origin\");\n      return;\n    }\n\n    // Enforce max clients\n    if (clients.size >= MAX_CLIENTS) {\n      sendTo(ws, { type: \"error\", code: \"SERVER_FULL\", message: \"Max clients reached\" });\n      ws.close(1013, \"Server full\");\n      return;\n    }\n\n    // Authorize\n    const auth = await authorizeConnection(request);\n    if (!auth.authorized) {\n      sendTo(ws, { type: \"error\", code: \"UNAUTHORIZED\", message: auth.error || \"Unauthorized\" });\n      ws.close(4001, \"Unauthorized\");\n      return;\n    }","sourceCodeStart":499,"sourceCodeEnd":535,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/server/ws/liveServer.ts#L499-L535","documentation":"Error \"Origin not allowed\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/server/ws/liveServer.ts:517 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}