Browser scene creation returns 503 behind reverse proxy

Browser scene creation returns 503 on reverse-proxied self-hosted editor

Reproduction

1. Deploy Pascal Editor behind a reverse proxy at https://pascal.example.com.
2. Set PASCAL_SCENE_API_ORIGINS=https://pascal.example.com.
3. Leave PASCAL_SCENE_API_TOKEN unset.
4. Open /scenes and click Create new scene.

The browser POST to /api/scenes fails with:

{"error":"scene_api_token_required"}

The UI displays Failed to create scene (503).

Root cause

scene-api-security.ts correctly validates the configured browser origin, but validateAuth() then requires a token for every non-loopback request. A same-origin browser request arriving through the reverse proxy is not identified as loopback. The frontend does not send Authorization or X-Pascal-Scene-Token, so scene creation cannot work with the documented public-origin configuration.

Expected behavior

A browser request from an origin listed in PASCAL_SCENE_API_ORIGINS should be accepted without an API token, while non-browser/API clients should continue to require token authentication.

Environment

• Pascal Editor deployed with Docker/Openship
• Public origin configured with PASCAL_SCENE_API_ORIGINS
• Reverse proxy terminates TLS