fix(playground): add CSRF token and Host/Origin checks to protect local API from cross-origin abuse

Author: msranjana

packages/moss-cli/src/moss_cli/commands/playground.py

@@ -9,6 +9,7 @@
 
 import asyncio
 import json
+import secrets
 import socket
 import webbrowser
 from http.server import HTTPServer, SimpleHTTPRequestHandler
@@ -50,10 +51,26 @@ class PlaygroundHandler(SimpleHTTPRequestHandler):
     so the project key is never exposed to the browser."""
 
     client: MossClient | None = None
+    _token: str = ""
+    _server_host: str = ""
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, directory=str(HERE / "playground"), **kwargs)
 
+    def _check_api_request(self) -> bool:
+        if self.headers.get("X-Moss-Token") != self._token:
+            self._send_json(403, {"error": "Forbidden: invalid or missing token"})
+            return False
+        host = self.headers.get("Host", "")
+        if host and host != self._server_host and host != self._server_host.replace("127.0.0.1", "localhost"):
+            self._send_json(403, {"error": "Forbidden: invalid Host header"})
+            return False
+        origin = self.headers.get("Origin", "")
+        if origin and origin != f"http://{self._server_host}":
+            self._send_json(403, {"error": "Forbidden: invalid Origin"})
+            return False
+        return True
+
     def _send_json(self, status: int, data: dict) -> None:
         body = json.dumps(data).encode("utf-8")
         self.send_response(status)
@@ -81,8 +98,12 @@ def do_GET(self) -> None:
             self.send_response(204)
             self.end_headers()
         elif path == "/api/indexes":
+            if not self._check_api_request():
+                return
             self._handle_list_indexes()
         elif path == "/api/index":
+            if not self._check_api_request():
+                return
             names = params.get("name", [])
             self._handle_get_index(names[0] if names else None)
         else:
@@ -93,6 +114,10 @@ def _serve_index(self) -> None:
             self._send_json(500, {"error": "Playground HTML not found"})
             return
         html = PLAYGROUND_HTML.read_text(encoding="utf-8")
+        html = html.replace(
+            "</title>",
+            f'</title>\n<meta name="moss-token" content="{self._token}" />',
+        )
         self._send_html(html)
 
     def _handle_list_indexes(self) -> None:
@@ -129,6 +154,8 @@ def log_message(self, format, *args):
             console.print(f"  [dim]{args[0]}[/dim]")
 
     def do_POST(self) -> None:
+        if not self._check_api_request():
+            return
         parsed = urlparse(self.path)
         path = parsed.path
         length = int(self.headers.get("Content-Length", 0))
@@ -238,6 +265,8 @@ def playground_command(
     server_addr = ("127.0.0.1", final_port)
 
     PlaygroundHandler.client = client
+    PlaygroundHandler._token = secrets.token_urlsafe(32)
+    PlaygroundHandler._server_host = f"127.0.0.1:{final_port}"
 
     server = HTTPServer(server_addr, PlaygroundHandler)
     url = f"http://127.0.0.1:{final_port}"

packages/moss-cli/src/moss_cli/playground/index.html

@@ -135,6 +135,13 @@ <h1>Moss <span>Playground</span></h1>
 </div>
 
 <script type="module">
+const mossToken = document.querySelector('meta[name="moss-token"]')?.getAttribute('content') || '';
+
+function apiFetch(path, options = {}) {
+  const headers = { ...options.headers, 'X-Moss-Token': mossToken };
+  return fetch(path, { ...options, headers });
+}
+
 let indexes = [];
 let currentIndex = null;
 let requestId = 0;
@@ -153,7 +160,7 @@ <h1>Moss <span>Playground</span></h1>
 
 async function fetchIndexes() {
   try {
-    const res = await fetch('/api/indexes');
+    const res = await apiFetch('/api/indexes');
     if (!res.ok) throw new Error('Failed to fetch indexes');
     const data = await res.json();
     indexes = data.indexes || [];
@@ -227,7 +234,7 @@ <h1>Moss <span>Playground</span></h1>
   loadStatus.textContent = 'Connecting to cloud...';
 
   try {
-    const res = await fetch('/api/load-index', {
+    const res = await apiFetch('/api/load-index', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ name }),
@@ -342,7 +349,7 @@ <h1>Moss <span>Playground</span></h1>
     if (placeholder) placeholder.innerHTML = '<p>Searching...</p>';
 
     try {
-      const res = await fetch('/api/query', {
+      const res = await apiFetch('/api/query', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ name: currentIndex, query, topK, alpha }),