-
fix(app-icons): fetch application favicons server-side (allow-listed origins, DB-cached) instead of from the browser
Release / version (push) Canceled after 0sRelease / frontend (push) Canceled after 0sRelease / linux (amd64) (push) Canceled after 0sRelease / linux (arm64) (push) Canceled after 0sRelease / windows (push) Canceled after 0sRelease / macos (push) Canceled after 0sRelease / release (push) Canceled after 0sBuild and Push Docker Image / build-and-push (push) Canceled after 0sLastSkywalker released this
2026-09-02 17:54:07 +03:00 The last icon fallback loaded /favicon.ico straight from the browser: from an https
dashboard that is mixed content (blocked) and a private-network request that Chrome >= 138 gates
behind the 'access other apps and services on this device' prompt. GET /api/v1/app-icons/favicon
?origin= now fetches on the node (self-signed OK, image-only, sniffed .ico/.svg), caches in the
app_icon_cache store like registry icons, and only for origins the node itself derived for its
applications (public URLs / published ports; set rebuilt every 30s) so it cannot be used for SSRF.
DuckDuckGo fallback only for public hostnames.Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com
Downloads