fix: lock the desktop backend to the app's own origin (GHSA-frx8-qqgg-7j7g)

src/backend/database/routes/users.ts

@@ -11,6 +11,7 @@ import { authLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
 import { parseUserAgent } from "../../utils/user-agent-parser.js";
+import { isDesktopAppOrigin } from "../../utils/cors-config.js";
 import { deleteUserAndRelatedData } from "./delete-user-data.js";
 import {
   allowsDesktopAutoSession,
@@ -744,7 +745,11 @@ router.get("/setup-required", async (req, res) => {
  */
 router.post("/internal/auto-session", async (req, res) => {
   try {
-    if (!allowsDesktopAutoSession() || !isLoopbackRequest(req)) {
+    if (
+      !allowsDesktopAutoSession() ||
+      !isLoopbackRequest(req) ||
+      !isDesktopAppOrigin(req.headers.origin)
+    ) {
       authLogger.warn(
         "Rejected non-loopback attempt to access auto-session endpoint",
         { source: req.ip },