After CSWSH fix in v1.28.2 (CVE-2026-22689), it seems like it's longer possible to connect to WS from another origin. My use-case for using the WS is to connect & watch the emails arriving to "inbox" during e2e tests. I have.

• Web application served from https://web-service
• Mailpit HTTP server running at https://email-service:8025

Tests need to listen for incoming emails via WebSocket (wss://email-service:8025/api/events) while the browser context is on https://web-service. After upgrading to v1.28.2+, all WebSocket connections fail with:

websocket: request origin not allowed by Upgrader.CheckOrigin

I found the --api-cors flag, but it seems it does not affect the WebSocket upgrade origin validation.

If this is a reasonable request then, perhaps, this could be solved by introducing another configuration flag, e.g. --ws-allowed-origins that accepts a comma-separated list of allowed origins for WebSocket connections:

To use like this, for example:

mailpit --ws-allowed-origins "https://web-service,https://localhost:3000"