From 78a2b41329d0cb8e06541df983e636e1392e8454 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 22 Apr 2026 05:28:17 +0000
Subject: [PATCH] Fix HTTP 403 on login: add Origin and Referer headers

UniFi OS enforces CSRF protection on the login endpoint itself and
returns 403 if Origin/Referer headers are absent, regardless of whether
the credentials are correct. Required headers:
  Origin: https://controller:port
  Referer: https://controller:port/login

Documented in Art-of-WiFi UniFi-API-client reference implementation.

https://claude.ai/code/session_01UsuvFAmmeagtQa14QA4iaq
---
 includes/UniFiController.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/includes/UniFiController.php b/includes/UniFiController.php
index 9ee254f..28a4e96 100644
--- a/includes/UniFiController.php
+++ b/includes/UniFiController.php
@@ -38,7 +38,11 @@ class UniFiController {
             CURLOPT_COOKIEFILE => $this->cookieFile,
             CURLOPT_TIMEOUT => 10,
             CURLOPT_CONNECTTIMEOUT => 5,
-            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
+            CURLOPT_HTTPHEADER => [
+                'Content-Type: application/json',
+                'Origin: ' . $this->controllerUrl,
+                'Referer: ' . $this->controllerUrl . '/login',
+            ],
             CURLOPT_HEADERFUNCTION => function($ch, $header) {
                 $parts = explode(':', $header, 2);
                 if (count($parts) === 2) {