- Shipped
- September 10, 2026 at 8:52 PM UTC
- Author
- Kamo
- Commit
- 1928983
On meet.kamocrm.com the hostname is the platform's for every organization that has no domain of its own, and nothing on the page ever told the sidecar which organization a room belonged to. The sidecar has resolved rooms (o<org id>-...) and ?org= since 483ac9c, but nothing passed them: - overrides.js and title.html asked /api/meet/org-settings with no room, so a tenant's lobby wore KamoCRM's branding; - config.js is SSI-included, and a subrequest carries no query of its own, so every tenant room got the PLATFORM's guest access, password and lobby rules, and Meet's dynamicBrandingUrl painted the platform's logo in-meeting; - the close pages are new documents with no room in their URL. The page now names its room and any ?org= on each request. nginx hands config.js the page's own URI in X-Original-URI, from which the sidecar takes the room and points Meet's branding at the same organization. The lobby leaves its room in this tab's sessionStorage for the close pages, and the welcome page passes ?org= through. A page that names no organization still resolves by host, as before. The guest-JWT password check already resolved the room's organization, so a tenant that requires a password now has that rule applied consistently: its rooms' config.js stops advertising an anonymous domain.