fix[frontend](proxy): removed origin header on localhost proxy

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Frontend Vite dev proxy config modified to conditionally alter Origin headers, risking auth/CSRF bypasses on critical paths.

• high frontend/vite.config.ts:31 — Modification to Origin header spoofing logic alters authentication/CSRF checks on proxy requests. Auth, crypto, and security-relevant proxy handling changes must be treated with high severity.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Stray statement outside any function in vite.config.ts and insecure origin-spoofing logic change.

• high frontend/vite.config.ts:26 — console.log(BACKEND_URL) is placed at the top level of the file outside of any function or configuration object, which will execute immediately upon module load and cause a syntax/runtime issue or clutter stdout.
• high frontend/vite.config.ts:31 — The origin spoofing check was inverted/loosened to allow missing origin headers ('!req.headers.origin'), bypassing intended origin restrictions and weakening CSRF/CORS protections.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Vite proxy configuration modified to conditionally spoof Origin headers on upstream requests based on untrusted client input.

• high frontend/vite.config.ts:31 — The proxy configuration now dynamically sets the 'Origin' header based on client-provided origin headers (req.headers.origin) rather than strictly enforcing the target API origin. This can allow attackers to bypass CORS and CSRF protections by crafting malicious Origin headers when connecting through the development proxy. Mitigation: Do not reflect or conditionally forward arbitrary client Origin headers to backend services; maintain a strict static Origin configuration.

🔴 go-deps — pending updates

🔍 Discovered 30 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/feeds:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

  📁 ./backend:
     - github.com/aws/aws-sdk-go-v2/config: v1.32.36 → v1.32.37
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.35 → v1.19.36
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.45.5 → v1.45.6
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.28

❌ Please update dependencies before merging.

[AlexSanchez-bit]

this will only apply on local dev servers, as backend will reject wierd origins on prod mode