Add `localhost:7445` to Quick Edit allowed parent origins by penalosa · Pull Request #13046 · cloudflare/workers-sdk

penalosa · 2026-03-24T18:37:20Z

This allows the production editor to be embedded in apps running locally.

changeset-bot · 2026-03-24T18:37:24Z

⚠️ No Changeset found

Latest commit: 08cb4a7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

workers-devprod · 2026-03-24T18:37:46Z

Codeowners approval required for this PR:

@cloudflare/wrangler

Show detailed file reviewers

packages/quick-edit/src/index.ts: [@cloudflare/wrangler]

ask-bonk · 2026-03-24T18:38:27Z

I'm Bonk, and I've done a quick review of your PR.

Review posted on PR #13046. Two issues flagged:

Redundancy: The addition makes LOCALHOST_ORIGIN_WILDCARDS and the isLocalDev conditional block dead code, since "http://localhost:*" is now unconditionally included. Suggested cleaning up the dead code via an inline suggestion.
Security (informational): This relaxes the production CSP to allow any localhost origin to embed Quick Edit in an iframe, whereas previously this was gated to local-dev-only. Low severity but worth confirming it's intentional.

github run

pkg-pr-new · 2026-03-24T18:40:49Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13046

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13046

miniflare

npm i https://pkg.pr.new/miniflare@13046

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13046

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13046

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13046

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13046

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13046

wrangler

npm i https://pkg.pr.new/wrangler@13046

commit: 08cb4a7

penalosa · 2026-03-30T12:01:15Z

/bonk add a commit to this PR changing to only allow localhost:8445

ask-bonk

The change itself is straightforward, but it introduces dead code and has a security implication worth calling out explicitly (both already noted by the bot reviews).

Dead code: After this change, LOCALHOST_ORIGIN_WILDCARDS (line 24) and the isLocalDev conditional block (lines 44-46) are redundant. "http://localhost:*" is now unconditionally present in ALLOWED_PARENT_ORIGIN_WILDCARDS, so the conditional push just adds a duplicate. If this is intentional, those should be cleaned up in the same PR.

Security posture change: Previously, http://localhost:* was only included in frame-ancestors and the postMessage allow-list when the Quick Edit worker was itself running on localhost (i.e. local dev via wrangler dev). This change makes production Quick Edit accept iframe embedding and postMessage IPC from any http://localhost:<port> origin. That means any local HTTP server on a user's machine (browser extensions, other local apps, etc.) can embed production Quick Edit and receive the MessagePort passed at workbench.ts:150. This is likely low-severity since it requires local access, but it's a deliberate relaxation of the production CSP — confirming this is intentional would be good.

If this is intentional, I'd suggest a follow-up commit that removes the now-dead LOCALHOST_ORIGIN_WILDCARDS constant and the isLocalDev conditional block to keep the code clean.

ask-bonk · 2026-03-30T12:02:16Z

I've posted a review on PR #13046. The review covers two points:

Dead code -- The LOCALHOST_ORIGIN_WILDCARDS constant and the isLocalDev conditional block (lines 24, 44-46) are now redundant since "http://localhost:*" is unconditionally included in ALLOWED_PARENT_ORIGIN_WILDCARDS. These should be cleaned up if the change is intentional.
Security posture -- This moves http://localhost:* from a local-dev-only allowance to an unconditional one, meaning production Quick Edit will accept iframe embedding and postMessage IPC from any localhost origin. Low severity since it requires local access, but it's a deliberate relaxation worth confirming as intentional.

github run

workers-devprod · 2026-03-30T12:04:21Z

Codeowners approval required for this PR:

@cloudflare/wrangler

Show detailed file reviewers

packages/quick-edit/src/index.ts: [@cloudflare/wrangler]

penalosa · 2026-03-31T16:24:28Z

/bonk add a commit to this PR changing to only allow localhost:8445

ask-bonk · 2026-03-31T16:26:07Z

Done. The commit (539750b) makes the following changes to packages/quick-edit/src/index.ts:

Replaced http://localhost:* with http://localhost:8445 -- moved from ALLOWED_PARENT_ORIGIN_WILDCARDS to ALLOWED_PARENT_ORIGINS since it's no longer a wildcard pattern.
Removed dead code -- deleted the LOCALHOST_ORIGIN_WILDCARDS constant, the isLocalDev variable, and the conditional block that pushed localhost wildcards, since they are no longer needed.

This tightens the allowed localhost origin from any port to only port 8445.

github run

ask-bonk · 2026-03-31T16:34:26Z

Done. I've made two changes in packages/quick-edit/src/index.ts:

Restored LOCALHOST_ORIGIN_WILDCARDS — brought back the LOCALHOST_ORIGIN_WILDCARDS constant (["http://localhost:*"]), the isLocalDev check (url.hostname === "localhost"), and the conditional block that pushes localhost wildcards only during local development. This restores the original security posture where http://localhost:* is only included in the CSP when Quick Edit is running locally.
Changed port from 8445 to 7445 — per the other review comment on line 10, updated the explicit localhost origin from http://localhost:8445 to http://localhost:7445.

github run

ask-bonk · 2026-03-31T16:35:25Z

This is already addressed — commit 6058f4e changed the port to 7445 and restored the LOCALHOST_ORIGIN_WILDCARDS block. No further changes needed.

ask-bonk · 2026-03-31T16:35:28Z

The port is already set to 7445 on line 10 of packages/quick-edit/src/index.ts, and the LOCALHOST_ORIGIN_WILDCARDS / isLocalDev code is properly restored. This was all handled by the previous commit 6058f4e. No additional changes are required.

github run

dario-piotrowicz

Could you explain the context for this PR what's special about port 7445? 😕

NuroDev · 2026-04-02T11:19:21Z

Could you explain the context for this PR what's special about port 7445? 😕

+1 to this. Would love a bit more detail on why this is needed @penalosa.

Replace http://localhost:* wildcard with http://localhost:8445 and clean up the now-unused LOCALHOST_ORIGIN_WILDCARDS constant and isLocalDev conditional block.

workers-devprod · 2026-04-13T19:35:20Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

workers-devprod

Codeowners reviews satisfied

Co-authored-by: ask-bonk[bot] <ask-bonk[bot]@users.noreply.github.com>

penalosa requested a review from a team as a code owner March 24, 2026 18:37

penalosa added the skip-pr-description-validation Skip validation of the required PR description format label Mar 24, 2026

penalosa requested a review from NuroDev March 24, 2026 18:37

workers-devprod added this to workers-sdk Mar 24, 2026

github-project-automation bot moved this to Untriaged in workers-sdk Mar 24, 2026

This comment was marked as resolved.

Sign in to view

penalosa marked this pull request as draft March 30, 2026 12:01

ask-bonk bot reviewed Mar 30, 2026

View reviewed changes

penalosa commented Mar 31, 2026

View reviewed changes

Comment thread packages/quick-edit/src/index.ts Outdated

Comment thread packages/quick-edit/src/index.ts

penalosa changed the title ~~Add localhost:* to Quick Edit allowed parent origins~~ Add localhost:7445 to Quick Edit allowed parent origins Mar 31, 2026

penalosa marked this pull request as ready for review March 31, 2026 16:56

dario-piotrowicz reviewed Mar 31, 2026

View reviewed changes

NuroDev approved these changes Apr 13, 2026

View reviewed changes

penalosa and others added 3 commits April 13, 2026 20:35

Update index.ts

7e9062f

Restrict allowed localhost origin to port 8445 only

7db869f

Replace http://localhost:* wildcard with http://localhost:8445 and clean up the now-unused LOCALHOST_ORIGIN_WILDCARDS constant and isLocalDev conditional block.

Restore LOCALHOST_ORIGIN_WILDCARDS for local dev and change port to 7445

08cb4a7

penalosa force-pushed the penalosa-patch-19 branch from 6058f4e to 08cb4a7 Compare April 13, 2026 19:35

penalosa requested a review from workers-devprod as a code owner April 13, 2026 19:35

workers-devprod approved these changes Apr 13, 2026

View reviewed changes

github-project-automation bot moved this from Untriaged to Approved in workers-sdk Apr 13, 2026

penalosa merged commit 8c4da77 into main Apr 13, 2026
50 checks passed

penalosa deleted the penalosa-patch-19 branch April 13, 2026 22:23

github-project-automation bot moved this from Approved to Done in workers-sdk Apr 13, 2026

petebacondarwin pushed a commit that referenced this pull request Apr 14, 2026

Add localhost:7445 to Quick Edit allowed parent origins (#13046)

e6ea7db

Co-authored-by: ask-bonk[bot] <ask-bonk[bot]@users.noreply.github.com>

Conversation

penalosa commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

workers-devprod commented Mar 24, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

ask-bonk bot commented Mar 24, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

penalosa commented Mar 30, 2026

Uh oh!

ask-bonk bot left a comment

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot commented Mar 30, 2026

Uh oh!

workers-devprod commented Mar 30, 2026

Uh oh!

penalosa commented Mar 31, 2026

Uh oh!

ask-bonk bot commented Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

ask-bonk bot commented Mar 31, 2026

Uh oh!

ask-bonk bot commented Mar 31, 2026

Uh oh!

ask-bonk bot commented Mar 31, 2026

Uh oh!

dario-piotrowicz left a comment

Choose a reason for hiding this comment

Uh oh!

NuroDev commented Apr 2, 2026

Uh oh!

workers-devprod commented Apr 13, 2026

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

penalosa commented Mar 24, 2026 •

edited

Loading

changeset-bot bot commented Mar 24, 2026 •

edited

Loading

pkg-pr-new bot commented Mar 24, 2026 •

edited

Loading