Skip to content

Conversation

jonathanfoster
Copy link
Contributor

@jonathanfoster jonathanfoster commented Aug 24, 2025

This PR resolves issues #38 and #43.

Issue #38 is resolved by updating the hoppscotch.backend.whitelistedOrigins named template to replace . with _ for the desktop app origin. This fix includes unit test coverage and has been verified manually.

Issue #43 is resolved by updating chart dependency versions and setting default image repositories to bitnamilegacy/*. This fix has been verified manually using e2e tests.

@jonathanfoster jonathanfoster force-pushed the fix/desktop-app-whitelisted-origin branch 2 times, most recently from 781c002 to 9dcd336 Compare August 26, 2025 03:14
@jonathanfoster
Copy link
Contributor Author

@liyasthomas Can you confirm what should be whitelisted for the desktop app? Here's what I have based on the desktop app README. Assume I'm self-hosting Hoppscotch on https://hoppscotch.example.com.

Requirements:

  • Backend whitelisted origins must include web app origin (e.g., https://hoppscotch.example.com)
  • Backend whitelisted origins must include backend origin (e.g., https://hoppscotch.example.com)
  • Backend whitelisted origins must include MacOS and Linux desktop app origin (e.g., app://hoppscotch_example_com)
  • Backend whitelisted origins must include Windows desktop app origin (e.g., http://app.hoppscotch_example_com)
  • Desktop app origin host must be normalized by replacing . with _ (e.g., hoppscotch.example.com becomes hoppscotch_example_com)

If I were to manually configure whitelisted origins, it would look like this:

hoppscotch:
  backend:
    whitelistedOrigins:
      - https://hoppscotch.example.com
      - app://hoppscotch_example_com
      - http://app.hoppscotch_example_com

Is this correct? Anything else to add? If not, then this PR is ready to go.

@jonathanfoster jonathanfoster force-pushed the fix/desktop-app-whitelisted-origin branch 2 times, most recently from f3f9f3a to d480325 Compare September 22, 2025 01:55
@nahidhasan94 nahidhasan94 self-requested a review September 29, 2025 13:28
@jonathanfoster jonathanfoster force-pushed the fix/desktop-app-whitelisted-origin branch from d480325 to 7dc7053 Compare October 4, 2025 15:58
@jonathanfoster jonathanfoster force-pushed the fix/desktop-app-whitelisted-origin branch from 7dc7053 to c8537f6 Compare October 4, 2025 16:05
@jonathanfoster jonathanfoster force-pushed the fix/desktop-app-whitelisted-origin branch from 1194162 to dc39834 Compare October 5, 2025 00:26
@jonathanfoster jonathanfoster marked this pull request as ready for review October 5, 2025 00:36
@nahidhasan94
Copy link
Collaborator

@liyasthomas Can you confirm what should be whitelisted for the desktop app? Here's what I have based on the desktop app README. Assume I'm self-hosting Hoppscotch on https://hoppscotch.example.com.

Requirements:

  • Backend whitelisted origins must include web app origin (e.g., https://hoppscotch.example.com)
  • Backend whitelisted origins must include backend origin (e.g., https://hoppscotch.example.com)
  • Backend whitelisted origins must include MacOS and Linux desktop app origin (e.g., app://hoppscotch_example_com)
  • Backend whitelisted origins must include Windows desktop app origin (e.g., http://app.hoppscotch_example_com)
  • Desktop app origin host must be normalized by replacing . with _ (e.g., hoppscotch.example.com becomes hoppscotch_example_com)

If I were to manually configure whitelisted origins, it would look like this:

hoppscotch:
  backend:
    whitelistedOrigins:
      - https://hoppscotch.example.com
      - app://hoppscotch_example_com
      - http://app.hoppscotch_example_com

Is this correct? Anything else to add? If not, then this PR is ready to go.

Yes, you are right.
If you run locally, the whitelist value would be:
WHITELISTED_ORIGINS=http://localhost:3170,http://localhost:3000,http://localhost:3100,app://localhost_3200,app://hoppscotch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants