harden websocket CheckOrigin

pkg/channels/pico/pico.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -73,10 +74,19 @@ func NewPicoChannel(cfg config.PicoConfig, messageBus *bus.MessageBus) (*PicoCha
 
 	allowOrigins := cfg.AllowOrigins
 	checkOrigin := func(r *http.Request) bool {
-		if len(allowOrigins) == 0 {
-			return true // allow all if not configured
-		}
 		origin := r.Header.Get("Origin")
+		// If no origins are configured, allow same-origin only (default Gorilla behavior).
+		if len(allowOrigins) == 0 {
+			if origin == "" {
+				return true
+			}
+			u, err := url.Parse(origin)
+			if err != nil {
+				return false
+			}
+			return u.Host == r.Host
+		}
+		// If origins are configured, check for '*' or exact match.
 		for _, allowed := range allowOrigins {
 			if allowed == "*" || allowed == origin {
 				return true