From 020410f964f3be0b85fe62078281a43f75fa9585 Mon Sep 17 00:00:00 2001
From: Rider Linden <rider@lindenlab.com>
Date: Thu, 24 Sep 2026 13:53:34 -0700
Subject: Issue websocket hardening.

---
 indra/llcorehttp/llwebsocketmgr.cpp | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

(limited to 'indra/llcorehttp/llwebsocketmgr.cpp')

diff --git a/indra/llcorehttp/llwebsocketmgr.cpp b/indra/llcorehttp/llwebsocketmgr.cpp
index 3c0e0ed952..ef07295eed 100644
--- a/indra/llcorehttp/llwebsocketmgr.cpp
+++ b/indra/llcorehttp/llwebsocketmgr.cpp
@@ -195,6 +195,7 @@ struct Server_impl
         mLocalOnly(local_only)
     {
 
+        mServer.set_validate_handler([this](websocketpp::connection_hdl hdl) { return this->onValidate(hdl); });
         mServer.set_open_handler([this](websocketpp::connection_hdl hdl) { this->onOpen(hdl); });
         mServer.set_close_handler([this](websocketpp::connection_hdl hdl) { this->onClose(hdl); });
         mServer.set_message_handler([this](websocketpp::connection_hdl hdl, Server_t::message_ptr msg) { this->onMessage(hdl, msg); });
@@ -311,6 +312,34 @@ struct Server_impl
         }
     }
 
+    /**
+     * @brief Decide whether an upgrade request is let in
+     * @param hdl WebSocket connection handle from websocketpp
+     * @return false to answer the request 403 and never open it
+     *
+     * Called by websocketpp once the request has been read, before it is
+     * answered: the owner says which origins it takes.
+     */
+    bool onValidate(websocketpp::connection_hdl hdl)
+    {
+        LL_PROFILE_ZONE_SCOPED_CATEGORY_WEBSOCKET;
+        websocketpp::lib::error_code ec;
+        Server_t::connection_ptr     con = mServer.get_con_from_hdl(hdl, ec);
+        if (ec || !con)
+        {
+            return false;
+        }
+        const std::string& origin = con->get_origin();
+        if (mOwner->acceptOrigin(origin))
+        {
+            return true;
+        }
+        // Once for each origin: a page can ask as often as it likes.
+        LL_WARNS_ONCE("WebSocket") << mOwner->mServerName << " refused a connection from origin " << origin << LL_ENDL;
+        con->set_status(websocketpp::http::status_code::forbidden);
+        return false;
+    }
+
     /**
      * @brief Handle new connection establishment event
      * @param hdl WebSocket connection handle from websocketpp
-- 
cgit v1.3