refactor(confighttp): HTML page handlers into generic getPage function (#4645)

src_assets/common/assets/web/config.html

@@ -247,6 +247,7 @@
               "bind_address": "",
               "port": 47989,
               "origin_web_ui_allowed": "lan",
+              "csrf_allowed_origins": "",
               "external_ip": "",
               "lan_encryption_mode": 0,
               "wan_encryption_mode": 1,

src_assets/common/assets/web/configs/tabs/Network.vue

@@ -127,6 +127,16 @@ const effectivePort = computed(() => +config.value?.port ?? defaultMoonlightPort
       <div class="form-text">{{ $t('config.origin_web_ui_allowed_desc') }}</div>
     </div>
 
+    <!-- CSRF Allowed Origins -->
+    <div class="mb-3">
+      <label for="csrf_allowed_origins" class="form-label">{{ $t('config.csrf_allowed_origins') }}</label>
+      <input type="text"
+             class="form-control"
+             id="csrf_allowed_origins"
+             v-model="config.csrf_allowed_origins" />
+      <div class="form-text">{{ $t('config.csrf_allowed_origins_desc') }}</div>
+    </div>
+
     <!-- External IP -->
     <div class="mb-3">
       <label for="external_ip" class="form-label">{{ $t('config.external_ip') }}</label>

src_assets/common/assets/web/public/assets/locale/en.json

@@ -161,6 +161,8 @@
     "controller_desc": "Allows guests to control the host system with a gamepad / controller",
     "credentials_file": "Credentials File",
     "credentials_file_desc": "Store Username/Password separately from Sunshine's state file.",
+    "csrf_allowed_origins": "CSRF Allowed Origins",
+    "csrf_allowed_origins_desc": "Comma-separated list of additional allowed origins for CSRF protection (appended to defaults: localhost variants and web UI port). Only add origins you trust. Each origin must include protocol and host (e.g., https://example.com).",
     "dd_config_ensure_active": "Activate the display automatically",
     "dd_config_ensure_only_display": "Deactivate other displays and activate only the specified display",
     "dd_config_ensure_primary": "Activate the display automatically and make it a primary display",