HOWTO: Use third-party web controls on 8.5+
Posted: Mon Dec 15, 2025 3:13 pm
I got back to folding after some time spent crunching Mersenne primes, and being the eager tester that I am, I installed the v8.5.3 client. Then I opened my old trusty "Folding@Home In The Dark" client from LAR systems... Oops! No connection!
A quick peek into the browser networks tab & the client log show that the websocket api connections are being bounced for having a wrong Origin, originating in the Server::corsCB() code. Basically the browser sends an "Origin:" header with the websocket api connection made to 127.0.0.1:7396 (the FAH control websocket) explaining on which website's behalf it's making this connection. The FAH client side only lets the connection through when the origin is inside a whitelist.
By default the allowlist is:
so https://webclient.lar.systems, which isn't on it, is blocked.
To completely disable the check (quite risky! now any webpage can control your local FAH) in v8.5, edit the config.xml to say:
To play it safe add it to the allow list, in theory, like this:
well. I actually could not get the below to work! THIS DOES NOT WORK AT ALL! IT BREAKS THE VANILLA CLIENT TOO!
PS: I have no idea why older versions did not trigger this check. The bulk of current corsCB() originated in 8.3.2 and I think it worked fine back then? Maybe my browser didn't send the header then? There was a slight change of the function in 8.5 in commit https://github.com/FoldingAtHome/fah-cl ... 21ab1a8705 and I think that's what made it serious.
PPS: Please someone tell me how to edit the allow list to something sensible. I do not want to run ".*" either and hell I don't want to tell people to do that. This is a dirty hack.
A quick peek into the browser networks tab & the client log show that the websocket api connections are being bounced for having a wrong Origin, originating in the Server::corsCB() code. Basically the browser sends an "Origin:" header with the websocket api connection made to 127.0.0.1:7396 (the FAH control websocket) explaining on which website's behalf it's making this connection. The FAH client side only lets the connection through when the origin is inside a whitelist.
By default the allowlist is:
Code: Select all
*\\.foldingathome\\.org http://((127.0.0.1)|(localhost))(:\\d+)?To completely disable the check (quite risky! now any webpage can control your local FAH) in v8.5, edit the config.xml to say:
Code: Select all
<config>
<allowed-origin-exprs v='.*'/>
</config>well. I actually could not get the below to work! THIS DOES NOT WORK AT ALL! IT BREAKS THE VANILLA CLIENT TOO!
Code: Select all
<config>
<!-- whatever else you have now -->
<allowed-origin-exprs v='https://webclient\.lar\.systems .*\\.foldingathome\\.org http://((127.0.0.1)|(localhost))(:\\d+)?'/>
</config>PPS: Please someone tell me how to edit the allow list to something sensible. I do not want to run ".*" either and hell I don't want to tell people to do that. This is a dirty hack.
