fix: harden WeKnora knowledge permissions and details

frontend-web/src/core/config/index.ts

@@ -13,19 +13,33 @@ export function buildIntranetSourceUrl(recUuid?: string | null): string {
   return `${INTRANET_SOURCE_URL_BASE}${encodeURIComponent(recUuid)}`;
 }
 
-function getBaseOrigin() {
+function getBaseOrigin() {
   if (typeof window !== "undefined") {
     return window.location.origin;
   }
   // Fallback for SSR
-  return "http://localhost:2026";
-}
-
-export function getBackendBaseURL() {
-  if (env.NEXT_PUBLIC_BACKEND_BASE_URL) {
-    return new URL(env.NEXT_PUBLIC_BACKEND_BASE_URL, getBaseOrigin())
-      .toString()
-      .replace(/\/+$/, "");
+  return "http://localhost:2026";
+}
+
+function alignLoopbackHostname(url: URL): URL {
+  if (typeof window === "undefined") return url;
+  const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+  if (
+    loopbackHosts.has(url.hostname) &&
+    loopbackHosts.has(window.location.hostname)
+  ) {
+    url.hostname = window.location.hostname;
+  }
+  return url;
+}
+
+export function getBackendBaseURL() {
+  if (env.NEXT_PUBLIC_BACKEND_BASE_URL) {
+    return alignLoopbackHostname(
+      new URL(env.NEXT_PUBLIC_BACKEND_BASE_URL, getBaseOrigin()),
+    )
+      .toString()
+      .replace(/\/+$/, "");
   } else {
     return "";
   }