From 7d9b7afce62ba2f08281aa80441f20429297943f Mon Sep 17 00:00:00 2001
From: Abdul Wahab <abdulwahabone@gmail.com>
Date: Sat, 15 Aug 2026 00:01:34 +0500
Subject: [PATCH] Allow bare loopback Host/Origin on port 80, where browsers
 omit the suffix

Bugbot caught that the exact-match allowlists 403 every request on --port 80
because browsers drop the default-port suffix; other ports stay strict.

Written with AI assistance under maintainer direction.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 skill/scripts/serve-question.mjs | 8 ++++++--
 tests/serve-question.test.mjs    | 8 ++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/skill/scripts/serve-question.mjs b/skill/scripts/serve-question.mjs
index be5965f20..e08052c48 100644
--- a/skill/scripts/serve-question.mjs
+++ b/skill/scripts/serve-question.mjs
@@ -1568,12 +1568,16 @@ ${buildPath?.toggle ? `<div id="bp-confirm" role="dialog" aria-modal="true" aria
 </script>`;
 }
 
+// Browsers omit the :80 suffix on the default HTTP port, so a server on
+// --port 80 sees bare loopback hosts and origins.
 function allowedHost(host, port) {
-  return host === `127.0.0.1:${port}` || host === `localhost:${port}`;
+  if (host === `127.0.0.1:${port}` || host === `localhost:${port}`) return true;
+  return port === 80 && (host === '127.0.0.1' || host === 'localhost');
 }
 
 function allowedOrigin(origin, port) {
-  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+  if (origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`) return true;
+  return port === 80 && (origin === 'http://127.0.0.1' || origin === 'http://localhost');
 }
 
 function rejectDetachedPost(req, res, url, port) {
diff --git a/tests/serve-question.test.mjs b/tests/serve-question.test.mjs
index bd5194d99..02f3daa1a 100644
--- a/tests/serve-question.test.mjs
+++ b/tests/serve-question.test.mjs
@@ -185,6 +185,14 @@ describe('serve-question', () => {
     });
     assert.equal(spoofedHostGet.status, 403);
 
+    // The bare-host allowance exists only for --port 80, where browsers omit
+    // the suffix; on any other port a portless Host stays rejected.
+    const bareHostGet = await rawRequest(port, {
+      path: '/',
+      headers: { Host: '127.0.0.1' },
+    });
+    assert.equal(bareHostGet.status, 403);
+
     const slashSlash = await rawRequest(port, {
       path: '//',
       headers: { Host: goodHost },