Skip to content

fix(dashboard): allow WebSocket connections from non-loopback IPs with --insecure #17922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kelsia14 wants to merge 2 commits into from
Closed

fix(dashboard): allow WebSocket connections from non-loopback IPs with --insecure #17922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
195511d
fix(dashboard): allow WebSocket connections from non-loopback IPs wit…
kelsia14 Apr 30, 2026
52ea197
chore: add kelsia14 to AUTHOR_MAP
kelsia14 Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 16 additions & 13 deletions hermes_cli/web_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,9 @@
# or HERMES_DASHBOARD_TUI=1. Set from :func:`start_server`.
_DASHBOARD_EMBEDDED_CHAT_ENABLED = False

# Allow non-loopback connections when --insecure is used. Set from :func:`start_server`.
_ALLOW_PUBLIC = False

# Simple rate limiter for the reveal endpoint
_reveal_timestamps: List[float] = []
_REVEAL_MAX_PER_WINDOW = 5
Expand Down Expand Up @@ -2724,10 +2727,10 @@ async def pty_ws(ws: WebSocket) -> None:
return

client_host = ws.client.host if ws.client else ""
if client_host and client_host not in _LOOPBACK_HOSTS:
# Allow non-loopback connections when --insecure is used.
if client_host and client_host not in _LOOPBACK_HOSTS and not _ALLOW_PUBLIC:
await ws.close(code=4403)
return

await ws.accept()

# --- spawn PTY ------------------------------------------------------
Expand Down Expand Up @@ -2832,10 +2835,11 @@ async def gateway_ws(ws: WebSocket) -> None:
return

client_host = ws.client.host if ws.client else ""
if client_host and client_host not in _LOOPBACK_HOSTS:
# Allow non-loopback connections when --insecure is used.
if client_host and client_host not in _LOOPBACK_HOSTS and not _ALLOW_PUBLIC:
await ws.close(code=4403)
return

# Note: handle_ws() does the actual ws.accept()
from tui_gateway.ws import handle_ws

await handle_ws(ws)
Expand Down Expand Up @@ -2865,17 +2869,16 @@ async def pub_ws(ws: WebSocket) -> None:
return

client_host = ws.client.host if ws.client else ""
if client_host and client_host not in _LOOPBACK_HOSTS:
# Allow non-loopback connections when --insecure is used.
if client_host and client_host not in _LOOPBACK_HOSTS and not _ALLOW_PUBLIC:
await ws.close(code=4403)
return

await ws.accept()
channel = _channel_or_close_code(ws)
if not channel:
await ws.close(code=4400)
return

await ws.accept()

try:
while True:
await _broadcast_event(channel, await ws.receive_text())
Expand All @@ -2895,17 +2898,16 @@ async def events_ws(ws: WebSocket) -> None:
return

client_host = ws.client.host if ws.client else ""
if client_host and client_host not in _LOOPBACK_HOSTS:
# Allow non-loopback connections when --insecure is used.
if client_host and client_host not in _LOOPBACK_HOSTS and not _ALLOW_PUBLIC:
await ws.close(code=4403)
return

await ws.accept()
channel = _channel_or_close_code(ws)
if not channel:
await ws.close(code=4400)
return

await ws.accept()

async with _event_lock:
_event_channels.setdefault(channel, set()).add(ws)

Expand Down Expand Up @@ -3483,8 +3485,9 @@ def start_server(
"""Start the web UI server."""
import uvicorn

global _DASHBOARD_EMBEDDED_CHAT_ENABLED
global _DASHBOARD_EMBEDDED_CHAT_ENABLED, _ALLOW_PUBLIC
_DASHBOARD_EMBEDDED_CHAT_ENABLED = embedded_chat
_ALLOW_PUBLIC = allow_public

_LOCALHOST = ("127.0.0.1", "localhost", "::1")
if host not in _LOCALHOST and not allow_public:
Expand Down
1 change: 1 addition & 0 deletions scripts/release.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@
"glesstech@gmail.com": "georgeglessner",
"maxim.smetanin@gmail.com": "maxims-oss",
"nazirulhafiy@gmail.com": "nazirulhafiy",
"kelsia014@gmail.com": "kelsia14",
"CREWorx@users.noreply.github.com": "BadTechBandit",
"yoimexex@gmail.com": "Yoimex",
"6548898+romanornr@users.noreply.github.com": "romanornr",
Expand Down
Loading