headroomlabs-ai/headroom · error · HTTPException

cross-origin request rejected

Error message

cross-origin request rejected

What it means

Error "cross-origin request rejected" thrown in headroomlabs-ai/headroom.

Source

Thrown at headroom/proxy/loopback_guard.py:245

    but its ``Origin:`` header reflects the page's actual origin. CORS alone
    does not stop this: CORS only blocks the attacker's JS from *reading* the
    response, not the server from acting on the request.

    Reject when ``Origin`` is present and does not itself name a loopback
    host, or is the opaque literal ``"null"`` (sandboxed iframe / ``file://``
    page). Requests with no ``Origin`` header (CLI tools, curl, ``TestClient``,
    same-origin simple navigations) pass through unchanged -- a real browser
    always sets ``Origin`` on cross-origin fetch/XHR.
    """
    if HTTPException is None:  # pragma: no cover - defensive
        raise RuntimeError("FastAPI is required for the same-origin guard")

    headers = getattr(request, "headers", None)
    origin = headers.get("origin") if headers is not None else None
    if not origin:
        return
    if origin == "null":
        raise HTTPException(status_code=403, detail="cross-origin request rejected")
    host_part = origin.split("://", 1)[-1].split("/", 1)[0]
    if not is_loopback_host_header(host_part):
        raise HTTPException(status_code=403, detail="cross-origin request rejected")

View on GitHub (pinned to 322425c43b)

Solutions

1. Send the request from the allowed origin/host (loopback) or configure the guard's allowed origins
2. Remove cross-origin browser headers (Origin/Referer) if calling from a non-browser client
3. If the rejection is wrong, review the loopback guard configuration

When it happens

Trigger: Raised when the loopback guard rejects a request whose Origin/Referer indicates a cross-origin (potentially browser-based CSRF/DNS-rebinding) attempt.

Common situations: See trigger scenarios.

AI-assisted analysis of headroomlabs-ai/headroom@322425c43b (2026-08-15). Data as JSON: /api/errors/e30ee949c178451c. Report an issue: GitHub.