torrentclaw/unarr
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions

fix(stream): allow unarr.app origins for /stream + /hls CORS

Browse source 
The daemon's baked-in CORS allowlist had the torrentclaw.com family but not
unarr.app — so on the unarr brand the browser dropped every /hls + /stream
response (no Access-Control-Allow-Origin) and the player reported "can't
connect to your agent" even though the agent was reachable. Add unarr.app +
www.unarr.app. (Dev over Tailscale uses cors_extra_origins for the raw IP
origin.) Found while testing the web player from an iPhone over Tailscale.
This commit is contained in:
Deivid Soto 2026-05-31 14:20:49 +02:00
parent 5d80ec57b9
commit 292d5923cf
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
internal/engine/validate.go
View file

@ -36,6 +36,11 @@ var defaultCORSAllowedOrigins = []string{
"https://staging.torrentclaw.com",
"https://torrentclaw.to",
"https://www.torrentclaw.to",
// unarr brand (separate deployment). The web player + agent endpoints run
// under unarr.app; without these the browser drops every /hls + /stream
// response (no Access-Control-Allow-Origin) and playback fails on unarr.
"https://unarr.app",
"https://www.unarr.app",
// Tor mirror — Tor Browser sends `Origin: http://<addr>.onion` (plain
// http, no port). Mirror address is the BUILT_IN_ONION constant from
// torrentclaw-web/src/lib/mirrors-config.ts; rotates rarely, kept in