A page on another origin of the same site (another port, or another subdomain of the server's domain) can act as the signed-in user. It sends, say, POST /api/v1/messages with Content-Type: text/plain and credentials: "include". The browser sends that without a preflight and attaches the SameSite=Strict cookie, since the site is the same, and the handler decodes the body without looking at its type, so the message goes out as the user. A plain HTML form can do the same with enctype="text/plain", and a cross-origin POST /api/v1/logout signs the user out. Found in the review of #269.
A request with Content-Type: application/json is not "simple": a browser preflights it, and the preflight fails for a credentialed request because the server never answers with Access-Control-Allow-Credentials (#261). So refusing every other type closes this.
Definition of done
A middleware in internal/middleware, used on the /api/v1 router in internal/server/routes.go: a POST, PUT or DELETE request whose Content-Type media type is not application/json (parameters such as charset allowed; parse with mime.ParseMediaType) gets 415 with the API's usual JSON error body, before the handler runs. A missing Content-Type is refused too.
The web client (web/) and neoirc-cli (internal/cli/api) send Content-Type: application/json on every such request, POST /api/v1/logout included.
README.md "Using the HTTP API": one convention bullet stating the rule and the 415, and every curl example for those requests carries the header.
Tests, table-driven, external test packages: text/plain, application/x-www-form-urlencoded, multipart/form-data and a missing type each get 415 and change nothing (no message stored, no logout); application/json and application/json; charset=utf-8 pass. A GET is unaffected.
The web client keeps working: load it in a headless browser in a container and use it (sign in, join, send, log out) before pushing.
Start after #261 is merged into next, since both change internal/middleware and internal/server/routes.go.
A page on another origin of the same site (another port, or another subdomain of the server's domain) can act as the signed-in user. It sends, say, `POST /api/v1/messages` with `Content-Type: text/plain` and `credentials: "include"`. The browser sends that without a preflight and attaches the `SameSite=Strict` cookie, since the site is the same, and the handler decodes the body without looking at its type, so the message goes out as the user. A plain HTML form can do the same with `enctype="text/plain"`, and a cross-origin `POST /api/v1/logout` signs the user out. Found in the review of https://git.eeqj.de/sneak/neoirc/pulls/269.
A request with `Content-Type: application/json` is not "simple": a browser preflights it, and the preflight fails for a credentialed request because the server never answers with `Access-Control-Allow-Credentials` (https://git.eeqj.de/sneak/neoirc/issues/261). So refusing every other type closes this.
## Definition of done
- A middleware in `internal/middleware`, used on the `/api/v1` router in `internal/server/routes.go`: a `POST`, `PUT` or `DELETE` request whose `Content-Type` media type is not `application/json` (parameters such as `charset` allowed; parse with `mime.ParseMediaType`) gets `415` with the API's usual JSON error body, before the handler runs. A missing `Content-Type` is refused too.
- The web client (`web/`) and `neoirc-cli` (`internal/cli/api`) send `Content-Type: application/json` on every such request, `POST /api/v1/logout` included.
- `README.md` "Using the HTTP API": one convention bullet stating the rule and the `415`, and every `curl` example for those requests carries the header.
- Tests, table-driven, external test packages: `text/plain`, `application/x-www-form-urlencoded`, `multipart/form-data` and a missing type each get `415` and change nothing (no message stored, no logout); `application/json` and `application/json; charset=utf-8` pass. A `GET` is unaffected.
- The web client keeps working: load it in a headless browser in a container and use it (sign in, join, send, log out) before pushing.
Start after https://git.eeqj.de/sneak/neoirc/issues/261 is merged into `next`, since both change `internal/middleware` and `internal/server/routes.go`.
Read first: `AGENTS.md`, `CONVENTIONS.md`, `REPO_POLICIES.md`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 23:08:35 +01:00
Built in #273. Every POST, PUT and DELETE under /api/v1/ now gets 415 unless its Content-Type is application/json. The web client and neoirc-cli already sent that header, so neither changed. In a headless browser the web client still signs in, joins, sends and quits, and a text/plainPOST from the page gets 415.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/neoirc/pulls/273. Every `POST`, `PUT` and `DELETE` under `/api/v1/` now gets `415` unless its `Content-Type` is `application/json`. The web client and `neoirc-cli` already sent that header, so neither changed. In a headless browser the web client still signs in, joins, sends and quits, and a `text/plain` `POST` from the page gets `415`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
A page on another origin of the same site (another port, or another subdomain of the server's domain) can act as the signed-in user. It sends, say,
POST /api/v1/messageswithContent-Type: text/plainandcredentials: "include". The browser sends that without a preflight and attaches theSameSite=Strictcookie, since the site is the same, and the handler decodes the body without looking at its type, so the message goes out as the user. A plain HTML form can do the same withenctype="text/plain", and a cross-originPOST /api/v1/logoutsigns the user out. Found in the review of #269.A request with
Content-Type: application/jsonis not "simple": a browser preflights it, and the preflight fails for a credentialed request because the server never answers withAccess-Control-Allow-Credentials(#261). So refusing every other type closes this.Definition of done
internal/middleware, used on the/api/v1router ininternal/server/routes.go: aPOST,PUTorDELETErequest whoseContent-Typemedia type is notapplication/json(parameters such ascharsetallowed; parse withmime.ParseMediaType) gets415with the API's usual JSON error body, before the handler runs. A missingContent-Typeis refused too.web/) andneoirc-cli(internal/cli/api) sendContent-Type: application/jsonon every such request,POST /api/v1/logoutincluded.README.md"Using the HTTP API": one convention bullet stating the rule and the415, and everycurlexample for those requests carries the header.text/plain,application/x-www-form-urlencoded,multipart/form-dataand a missing type each get415and change nothing (no message stored, no logout);application/jsonandapplication/json; charset=utf-8pass. AGETis unaffected.Start after #261 is merged into
next, since both changeinternal/middlewareandinternal/server/routes.go.Read first:
AGENTS.md,CONVENTIONS.md,REPO_POLICIES.md.Model: opus-5-5
Built in #273. Every
POST,PUTandDELETEunder/api/v1/now gets415unless itsContent-Typeisapplication/json. The web client andneoirc-clialready sent that header, so neither changed. In a headless browser the web client still signs in, joins, sends and quits, and atext/plainPOSTfrom the page gets415.Model: opus-5-5