chore: add get-starknet proxying for dapp testing - #569
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| set -e | ||
|
|
||
| PROXY_HOST="127.0.0.1" | ||
| PROXY_PORT="8088" |
There was a problem hiding this comment.
Wrong proxy port causes setup to fail
High Severity
The PROXY_PORT is set to "8088" but mitmproxy's default port is 8888. The comment on line 3 and the README both correctly reference port 8888. This typo causes the system proxy to be configured on the wrong port, so traffic will not route through mitmproxy, making the entire proxy setup non-functional.
| Intercept HTTP requests and redirect get-starknet requests based on configuration. | ||
| """ | ||
| # Only handle get-starknet requests | ||
| if PRODUCTION_HOST in flow.request.pretty_host and "/starknet/get-starknet/v1/" in flow.request.path: |
There was a problem hiding this comment.
Proxy intercepts dev server requests due to substring match
Medium Severity
The host check uses PRODUCTION_HOST in flow.request.pretty_host with substring matching. Since PRODUCTION_HOST is "snaps.consensys.io" and DEV_HOST is "dev.snaps.consensys.io", the condition matches both hosts. In "local" mode, requests to the dev server will be incorrectly redirected to localhost, causing unexpected failures when developers use both environments simultaneously.
| flow.response.headers["Access-Control-Allow-Origin"] = "*" | ||
| flow.response.headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, DELETE, PATCH, OPTIONS" | ||
| flow.response.headers["Access-Control-Allow-Headers"] = "X-Requested-With, content-type, Authorization" | ||
| flow.response.headers["Access-Control-Allow-Credentials"] = "true" |
There was a problem hiding this comment.
Invalid CORS headers combination breaks credentialed requests
Low Severity
Setting Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true is invalid per the CORS specification. Browsers will reject responses with this combination when the request includes credentials (cookies, auth headers). This can cause confusing CORS errors that seem unrelated to credentials.
|
|
1 participant
Note
Medium Risk
Primarily dev tooling, but it introduces proxy scripts that can intercept HTTPS traffic and changes
webpack-dev-serverhost validation (allowedHosts: 'all'), which could be misused if run in unsafe environments.Overview
Adds a mitmproxy-based workflow for testing local
get-starknetchanges against external dapps by redirecting production CDN requests (snaps.consensys.io/starknet/get-starknet/v1/*) to eitherlocalhost:8082ordev.snaps.consensys.ioviaGET_STARKNET_PROXY_TARGET.Includes new
yarn proxy:*scripts, macOS helper scripts to enable/disable system proxy, and updates the local webpack dev server to allow all hosts for proxying and to ensure CORS headers are present.Written by Cursor Bugbot for commit 6049cec. This will update automatically on new commits. Configure here.