From 62ba09d25ef18e777b4e79bc8308cadb9fd125f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Sat, 15 Aug 2026 14:33:00 +0300 Subject: [PATCH] Probe: require JSON version field to confirm same-origin API SPA-fallback static hosts return 200 HTML for /api/version, which falsely triggered same-origin mode. Now validate the body parses as JSON with a string version field before switching to a relative base. --- frontend/index.html | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/frontend/index.html b/frontend/index.html index ebf59d5..ba83baf 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -2644,13 +2644,14 @@ let pysimBase = 'http://127.0.0.1:8080'; async function pysimDetectSameOrigin() { try { const res = await fetch('/api/version', { method: 'GET', cache: 'no-store' }); - if (res.ok) { - pysimBase = ''; - const urlEl = document.getElementById('pysim-url'); - if (urlEl) { urlEl.value = ''; urlEl.placeholder = '(same origin)'; } - } + if (!res.ok) return; + const data = await res.json(); + if (!data || typeof data.version !== 'string') return; + pysimBase = ''; + const urlEl = document.getElementById('pysim-url'); + if (urlEl) { urlEl.value = ''; urlEl.placeholder = '(same origin)'; } } catch (e) { - // no co-located API (file://, plain static server) — keep the default + // no co-located API (file://, plain static server, SPA fallback) — keep default } } pysimDetectSameOrigin();