From c6edf785459a1a4c0b068b8296c2db075a88dcdd Mon Sep 17 00:00:00 2001 From: Connor Johnstone Date: Mon, 14 Sep 2026 15:55:38 -0400 Subject: [PATCH] sunshine: allow the LAN origins past CSRF MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reaching the web UI from another machine sends an Origin header naming this host rather than localhost, and Sunshine's CSRF check rejects it: Web UI: [10.0.0.8] -- CSRF protection blocked request from origin: https://10.0.0.2:47990 csrf_allowed_origins takes a comma-separated list of bare origins, NOT a JSON array — brackets and quotes are rejected entry by entry, which is how the first attempt failed. Both the IP and hostname spellings are listed because the browser sends whichever was typed. origin_web_ui_allowed=lan set explicitly alongside it, so the two settings that gate remote access to the UI are stated in one place. --- hosts/mainframe/sunshine/sunshine.conf | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hosts/mainframe/sunshine/sunshine.conf b/hosts/mainframe/sunshine/sunshine.conf index 72a44ff..da48c39 100644 --- a/hosts/mainframe/sunshine/sunshine.conf +++ b/hosts/mainframe/sunshine/sunshine.conf @@ -15,3 +15,13 @@ nvenc_preset = 1 nvenc_twopass = quarter_res min_log_level = warning + +# The web UI is reached from other machines on the LAN, so their Origin header +# names this host rather than localhost and Sunshine's CSRF check rejects it. +# Both spellings are listed because the browser sends whichever you typed. +# Comma-separated bare origins — not a JSON array; brackets and quotes are +# rejected entry by entry. +csrf_allowed_origins = https://10.0.0.2:47990,https://mainframe:47990,https://localhost:47990 + +# Web UI reachable from the LAN, not just this machine. +origin_web_ui_allowed = lan