Reject cross-origin upgrades at the preview proxy

internal/agents/preview.go

@@ -145,7 +145,20 @@ func (m *Manager) servePreview(port int) error {
 		},
 		FlushInterval: -1,
 	}
+	protection := http.NewCrossOriginProtection()
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		check := r
+		if r.Header.Get("Upgrade") != "" {
+			// An upgraded GET opens a bidirectional channel, so it needs the
+			// same origin checks as a state-changing request.
+			upgrade := *r
+			upgrade.Method = http.MethodPost
+			check = &upgrade
+		}
+		if err := protection.Check(check); err != nil {
+			http.Error(w, err.Error(), http.StatusForbidden)
+			return
+		}
 		host := r.Host
 		if h, _, err := net.SplitHostPort(host); err == nil {
 			host = h
@@ -170,7 +183,7 @@ func (m *Manager) servePreview(port int) error {
 		proxy.ServeHTTP(w, r)
 	})
 	go func() {
-		err := (&http.Server{Handler: http.NewCrossOriginProtection().Handler(handler)}).Serve(tracked)
+		err := (&http.Server{Handler: handler}).Serve(tracked)
 		if !errors.Is(err, net.ErrClosed) {
 			slog.Error("serve preview", "port", port, "err", err)
 		}