Implemented better testing and fixed skipepd frames

Common/Client/go/wshub/hub.go

@@ -122,10 +122,48 @@ func (c *wsClient) readPump() {
 
 // ─── Hub ─────────────────────────────────────────────────────────────────────
 
+// allowedOrigins is the set of Origin values (scheme://host[:port]) that are
+// accepted for WebSocket upgrades.  If empty, same-origin is enforced by
+// comparing the Origin's host to the HTTP Host header.
+var allowedOrigins []string
+
+// SetAllowedOrigins configures the WebSocket Origin allowlist.  Pass an empty
+// slice to enforce same-origin only (the default).
+func SetAllowedOrigins(origins []string) {
+	allowedOrigins = origins
+}
+
+// checkOrigin validates the Origin header against the allowlist, falling back
+// to a same-origin check (Origin host == Host header) when no allowlist is
+// configured.  Requests with no Origin header (non-browser clients) are allowed.
+func checkOrigin(r *http.Request) bool {
+	origin := r.Header.Get("Origin")
+	if origin == "" {
+		return true // non-browser client
+	}
+	// Check explicit allowlist first.
+	for _, allowed := range allowedOrigins {
+		if origin == allowed {
+			return true
+		}
+	}
+	// Fall back to same-origin: compare the Origin's host to the Host header.
+	// Origin format: "scheme://host[:port]" — strip scheme.
+	host := origin
+	if idx := strings.Index(host, "://"); idx >= 0 {
+		host = host[idx+3:]
+	}
+	// Strip path if present.
+	if idx := strings.Index(host, "/"); idx >= 0 {
+		host = host[:idx]
+	}
+	return host == r.Host
+}
+
 var upgrader = websocket.Upgrader{
 	ReadBufferSize:  4096,
 	WriteBufferSize: 64 * 1024,
-	CheckOrigin:     func(r *http.Request) bool { return true },
+	CheckOrigin:     checkOrigin,
 }
 
 // sourceHubState holds all data for one active data source.