fixed case sensitive origin check and update tests

pkg/channels/pico/pico.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -72,21 +71,15 @@ func NewPicoChannel(cfg config.PicoConfig, messageBus *bus.MessageBus) (*PicoCha
 
 	base := channels.NewBaseChannel("pico", cfg, messageBus, cfg.AllowFrom)
 
+	// When AllowOrigins is empty, leave CheckOrigin nil so gorilla/websocket
+	// uses its built-in same-origin check (handles case-insensitive hostnames
+	// and port matching correctly). Only set a custom function when explicit
+	// origins are configured.
+	var checkOrigin func(*http.Request) bool
+	if len(cfg.AllowOrigins) > 0 {
 		allowOrigins := cfg.AllowOrigins
-	checkOrigin := func(r *http.Request) bool {
+		checkOrigin = func(r *http.Request) bool {
 			origin := r.Header.Get("Origin")
-		// If no origins are configured, allow same-origin only (default Gorilla behavior).
-		if len(allowOrigins) == 0 {
-			if origin == "" {
-				return true
-			}
-			u, err := url.Parse(origin)
-			if err != nil {
-				return false
-			}
-			return u.Host == r.Host
-		}
-		// If origins are configured, check for '*' or exact match.
 			for _, allowed := range allowOrigins {
 				if allowed == "*" || allowed == origin {
 					return true
@@ -94,6 +87,7 @@ func NewPicoChannel(cfg config.PicoConfig, messageBus *bus.MessageBus) (*PicoCha
 			}
 			return false
 		}
+	}
 
 	return &PicoChannel{
 		BaseChannel: base,

pkg/channels/pico/pico_test.go

@@ -148,33 +148,11 @@ func (c *PicoChannel) addConnForTest(pc *picoConn) {
 func TestNewPicoChannel_UsesSameOriginCheckWithoutAllowOrigins(t *testing.T) {
 	ch := newTestPicoChannel(t)
 
-	// If CheckOrigin is nil, the implementation is relying on gorilla/websocket's
+	// When AllowOrigins is empty, CheckOrigin must be nil so gorilla/websocket
-	// default same-origin enforcement. In that case we don't assert the internal
+	// uses its built-in same-origin enforcement (which correctly handles
-	// behaviour here to avoid coupling this test to that implementation detail.
+	// case-insensitive hostnames and port matching).
-	if ch.upgrader.CheckOrigin == nil {
+	if ch.upgrader.CheckOrigin != nil {
-		t.Skip("CheckOrigin is nil; relying on default same-origin enforcement")
+		t.Fatal("CheckOrigin should be nil when AllowOrigins is empty, to use gorilla's default same-origin check")
-	}
-
-	if !ch.upgrader.CheckOrigin(&http.Request{
-		Host: "example.com",
-		Header: http.Header{
-			"Origin": []string{"https://example.com"},
-		},
-	}) {
-		t.Fatal("CheckOrigin rejected same-origin request")
-	}
-
-	if ch.upgrader.CheckOrigin(&http.Request{
-		Host: "example.com",
-		Header: http.Header{
-			"Origin": []string{"https://other.example"},
-		},
-	}) {
-		t.Fatal("CheckOrigin accepted cross-origin request")
-	}
-
-	if !ch.upgrader.CheckOrigin(&http.Request{Host: "example.com"}) {
-		t.Fatal("CheckOrigin rejected request without Origin header")
 	}
 }