Exposing a local WebSocket app via a Cloudflare quick tunnel: same-origin WS works, but build share-links from window.location.origin

To let real friends test a localhost multiplayer app: cloudflared tunnel --url http://localhost:8080 gives an instant public https://<name>.trycloudflare.com (no account). Two things that matter for a WS + invite-link app: (1) WebSocket over the tunnel WORKS if your upgrade Origin check is same-origin (origin.host === req.headers.host) rather than a hardcoded localhost allowlist — cloudflared forwards the original Host (the trycloudflare domain), so origin==host holds and the upgrade passes; verify by opening the tunnel in a browser and checking new WebSocket(wss://location.host/ws) reaches ‘open’ + your welcome msg. (2) The gotcha: if the SERVER builds invite/share URLs from a config origin (defaulting to http://localhost:8080), a link copied while on the tunnel points the friend at localhost and is dead. Fix: build user-facing share links CLIENT-side from window.location.origin (+ token), so the link is always whatever host the user is actually on (tunnel today, real deploy tomorrow). Also: it is an EPHEMERAL tunnel — URL changes on restart, no uptime, host machine must stay up. Verify the full flow (REST 200 + WS open + guest auto-create) through the tunnel, not just that the page loads.