Allow bare loopback Host/Origin on port 80, where browsers omit the suffix

Bugbot caught that the exact-match allowlists 403 every request on --port 80
because browsers drop the default-port suffix; other ports stay strict.

Written with AI assistance under maintainer direction.

Co-authored-by: Cursor <cursoragent@cursor.com>

skill/scripts/serve-question.mjs

@@ -1568,12 +1568,16 @@ ${buildPath?.toggle ? `<div id="bp-confirm" role="dialog" aria-modal="true" aria
 </script>`;
 }
 
+// Browsers omit the :80 suffix on the default HTTP port, so a server on
+// --port 80 sees bare loopback hosts and origins.
 function allowedHost(host, port) {
-  return host === `127.0.0.1:${port}` || host === `localhost:${port}`;
+  if (host === `127.0.0.1:${port}` || host === `localhost:${port}`) return true;
+  return port === 80 && (host === '127.0.0.1' || host === 'localhost');
 }
 
 function allowedOrigin(origin, port) {
-  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+  if (origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`) return true;
+  return port === 80 && (origin === 'http://127.0.0.1' || origin === 'http://localhost');
 }
 
 function rejectDetachedPost(req, res, url, port) {

tests/serve-question.test.mjs

@@ -185,6 +185,14 @@ describe('serve-question', () => {
     });
     assert.equal(spoofedHostGet.status, 403);
 
+    // The bare-host allowance exists only for --port 80, where browsers omit
+    // the suffix; on any other port a portless Host stays rejected.
+    const bareHostGet = await rawRequest(port, {
+      path: '/',
+      headers: { Host: '127.0.0.1' },
+    });
+    assert.equal(bareHostGet.status, 403);
+
     const slashSlash = await rawRequest(port, {
       path: '//',
       headers: { Host: goodHost },