Skip to content

fix: update host_permissions in manifest to match actual backend URLs #650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
laibulous wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: update host_permissions in manifest to match actual backend URLs #650

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e41059c
fix: update host_permissions in manifest to match actual backend URLs
laibulous Mar 30, 2026
e14562f
fix: use http scheme in host_permissions to match backend calls
laibulous Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion extension/public/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@
"default_path":"/src/pages/question/sidePanel.html"
},
"host_permissions": [
"http://127.0.0.1:8000/*"
"http://127.0.0.1:5000/*",
"https://localhost:5000/*"

@coderabbitai coderabbitai Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Add http://localhost:5000/* (scheme mismatch currently breaks allowed-origin matching).

Line 15 grants https://localhost:5000/*, but the code calls http://localhost:5000/* (e.g., extension/src/pages/text_input/TextInput.jsx, extension/src/pages/answer/Answer.jsx, extension/src/pages/question/SidePanel.jsx). Because scheme is part of host permission matching, those HTTP requests can still be blocked.

Proposed fix 
   "host_permissions": [
     "http://127.0.0.1:5000/*",
-    "https://localhost:5000/*"
+    "http://localhost:5000/*"
   ],
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@extension/public/manifest.json` around lines 14 - 15, The manifest currently
allows "http://127.0.0.1:5000/*" and "https://localhost:5000/*" but omits
"http://localhost:5000/*", causing scheme mismatch and blocked requests from
components like TextInput.jsx, Answer.jsx and SidePanel.jsx; update
extension/public/manifest.json to include "http://localhost:5000/*" in the host
permissions/origins array so the HTTP scheme for localhost is explicitly allowed
and matches the requests from those components.

],
"icons": {
"16": "aossie_logo16.png"
Expand Down