fix[frontend](proxy): setted up vite proxy to work on both remote and…

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — High/critical findings

One or more high/critical issues were found. Please review and fix before merging if they're real.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Frontend Vite configuration updated to correctly use Vite's loadEnv and refine proxy origin spoofing.

No findings.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Vite proxy config introduces logic that unconditionally modifies Origin and Referer for non-localhost requests, which can break CORS/CSRF protections on proxied backend endpoints.

• high frontend/vite.config.ts:31 — The proxy rewrite logic checks if req.headers.origin starts with 'http://localhost' and returns early, meaning any other origin (including production domains if misconfigured, or arbitrary external origins in certain dev setups) will have their Origin and Referer headers forcefully rewritten to API_TARGET. This bypasses browser CSRF protections and can cause unexpected cross-origin request failures or security bypasses.

⚠️ security (gemini-3-flash-lite) — minor findings

Summary: Modified Vite proxy configuration to selectively bypass Origin spoofing for local hosts.

• medium frontend/vite.config.ts:30 — The proxy configuration bypasses Origin header rewriting when requests originate from 'http://localhost'. Ensure this dev-only bypass cannot be inadvertently enabled or leveraged in production environments to perform CSRF against proxied backends.

🔴 go-deps — pending updates

🔍 Discovered 30 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/feeds:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./backend:
     - github.com/aws/aws-sdk-go-v2/config: v1.32.36 → v1.32.37
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.35 → v1.19.36
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.45.5 → v1.45.6
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

❌ Please update dependencies before merging.

[AlexSanchez-bit]

that localhost validation is needed for dev env will not be used on production setups