Eclair v0.14.4 now rejects Lightning node API requests carrying an Origin header with HTTP 403, limiting browser-triggered commands against authenticated nodes while preserving command-line access.
Released Oct. 15, the patch sends that response before an API endpoint processes a marked request. Browser interfaces hosted alongside the node face the same restriction.
The update addresses a risk tied to HTTP Basic authentication. A malicious website could get a browser holding saved credentials to submit an API command; although the site might not see the response, Eclair could still carry out the action. The API exposes node information and can control payment channels and payments.
Operators can still use curl and eclair-cli. Browser dashboards that used to call the node directly need a server component to relay those requests.
Because nonbrowser clients can omit Origin, the header check is not authentication; operators should keep the API bound to loopback. The upgrade can be applied during a restart without closing open channels.
