Add new option to allow cross origin requests to WS endpoint

server/handlers.go

@@ -31,7 +31,6 @@ func (server *Server) generateHandleWS(ctx context.Context, cancel context.Cance
 		if server.options.Once {
 			success := atomic.CompareAndSwapInt64(once, 0, 1)
 			if !success {
-
 				http.Error(w, "Server is shutting down", http.StatusServiceUnavailable)
 				return
 			}
@@ -68,7 +67,7 @@ func (server *Server) generateHandleWS(ctx context.Context, cancel context.Cance
 
 		conn, err := server.upgrader.Upgrade(w, r, nil)
 		if err != nil {
-			http.Error(w, "Failed to upgrade connection: "+err.Error(), 500)
+			closeReason = fmt.Sprintf("origin check error: %s", r.Header.Get("Origin"))
 			return
 		}
 		defer conn.Close()

server/options.go

@@ -28,6 +28,7 @@ type Options struct {
 	Preferences         *HtermPrefernces `hcl:"preferences"`
 	Width               int              `hcl:"width" flagName:"width" flagDescribe:"Static width of the screen, 0(default) means dynamically resize" default:"0"`
 	Height              int              `hcl:"height" flagName:"height" flagDescribe:"Static height of the screen, 0(default) means dynamically resize" default:"0"`
+	WSOrigin            string           `hcl:"ws_origin" flagName:"ws-origin" flagDescribe:"A regular expression that matches origin URLs to be accepted by WebSocket. No cross origin requests are acceptable by default" default:""`
 
 	TitleVariables map[string]interface{}
 }

server/server.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"regexp"
 	noesctmpl "text/template"
 	"time"
 
@@ -56,6 +57,17 @@ func New(factory Factory, options *Options) (*Server, error) {
 		return nil, errors.Wrapf(err, "failed to parse window title format `%s`", options.TitleFormat)
 	}
 
+	var originChekcer func(r *http.Request) bool
+	if options.WSOrigin != "" {
+		matcher, err := regexp.Compile(options.WSOrigin)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to compile regular expression of Websocket Origin: %s", options.WSOrigin)
+		}
+		originChekcer = func(r *http.Request) bool {
+			return matcher.MatchString(r.Header.Get("Origin"))
+		}
+	}
+
 	return &Server{
 		factory: factory,
 		options: options,
@@ -64,6 +76,7 @@ func New(factory Factory, options *Options) (*Server, error) {
 			ReadBufferSize:  1024,
 			WriteBufferSize: 1024,
 			Subprotocols:    webtty.Protocols,
+			CheckOrigin:     originChekcer,
 		},
 		indexTemplate: indexTemplate,
 		titleTemplate: titleTemplate,