[Bug] Open web server manipulable by any web page

[briansniffen]

Description

The web server this software exposes is accessible to any web page the user's browsing. Because it disables CORS (see

Perspective-Server/Perspective Server/LocalHTTPServer.swift

Line 106 in 68be432

"Access-Control-Allow-Origin": "*",

), any web page can send arbitrary commands to the local model, and then receive responses.

Steps to Reproduce

Browse to a web page that has scripts accessing localhost:11434.

Expected Behavior

Scripts cannot interact with my local agent

Actual Behavior

Scripts talk to my local agent, make changes on my behalf, extract my data.

Context

Ollama, OpenClaw, etc. have recently wrestled with similar design flaws. There's a rich library of techniques to prevent this, including using the filesystem to share a token between the client and server, CORS headers restricting the origin to a browser extension or localhost, etc. Happy to chat more about those. This is unsafe for users as written.

[taylorarndt]

Thanks for reporting this — great catch and well explained. I am actively working on addressing this. Appreciate the pointers to how Ollama and others have handled it.

[taylorarndt]

Thanks again for reporting this. I’ve fixed the issue in the current beta and also addressed the regressions introduced while hardening that path.\n\nBeta release notes:\nhttps://github.com/Techopolis/Perspective-Server/releases/tag/v1.1.0-beta.2\n\nIf you have a chance to test it, please let me know if you still see any problems or if anything about the fix looks incomplete.