lightgun-poc / lib/auth
lib/auth
Session-key gate for the two aim intakes (WebSocket upgrade, /rtc/offer).
Why CORS is not enough: the allowlist in lib/cors only constrains browsers — a non-browser client (curl, a script, any laptop on the same WiFi) sends no Origin header and passes it untouched, and the WebSocket never had an origin check at all. These sockets end at the mouse and keyboard, so network clients must present a shared secret.
The key rides the URL fragment (#pc=…&key=…), same as the LAN addresses: fragments never leave the phone, so the page host (GitHub Pages, ngrok) learns nothing. The phone page echoes it back in the signaling body and the WS query string.
Loopback is exempt by default: the adb/USB flow types http://localhost:8443 by hand, and a process that can connect to loopback is already on this machine, where it could move the mouse directly. The exemption MUST be dropped when an in-process tunnel is up — ngrok's agent forwards the public internet to loopback.