A browser sends a text/plain or form POST to another origin of the same site without a preflight, and attaches the SameSite=Strict cookie. A page there could therefore send messages or log the user out.
RequireJSON in internal/middleware runs on the whole /api/v1 router. A POST, PUT or DELETE whose media type is not application/json, or that has no Content-Type, gets 415 with {"error":"content type must be application/json"} before the handler runs. Parameters such as charset are allowed.
Because the check runs on the router, a non-JSON POST to an unknown path under /api/v1/ gets 415 before the router would answer 404 or 405.
README.md: one convention bullet under "Using the HTTP API", one sentence under "Other paths" on that 415, plus the internal/middleware/ layout line. The curl examples already carried the header.
Tests: a table in internal/middleware covers methods and types. One in internal/handlers checks that refused sends store no message and refused logouts leave the client signed in.
The test helper doRequestAuth now sets the header on every non-GET request, because the logout tests send no body.
Not in the diff:
The web client and neoirc-cli already send Content-Type: application/json on every request, so neither changed. Neither calls POST /api/v1/logout.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/neoirc/issues/271.
A browser sends a `text/plain` or form `POST` to another origin of the same site without a preflight, and attaches the `SameSite=Strict` cookie. A page there could therefore send messages or log the user out.
- `RequireJSON` in `internal/middleware` runs on the whole `/api/v1` router. A `POST`, `PUT` or `DELETE` whose media type is not `application/json`, or that has no `Content-Type`, gets `415` with `{"error":"content type must be application/json"}` before the handler runs. Parameters such as `charset` are allowed.
- Because the check runs on the router, a non-JSON `POST` to an unknown path under `/api/v1/` gets `415` before the router would answer `404` or `405`.
- `README.md`: one convention bullet under "Using the HTTP API", one sentence under "Other paths" on that `415`, plus the `internal/middleware/` layout line. The `curl` examples already carried the header.
- Tests: a table in `internal/middleware` covers methods and types. One in `internal/handlers` checks that refused sends store no message and refused logouts leave the client signed in.
- The test helper `doRequestAuth` now sets the header on every non-`GET` request, because the logout tests send no body.
Not in the diff:
- The web client and `neoirc-cli` already send `Content-Type: application/json` on every request, so neither changed. Neither calls `POST /api/v1/logout`.
Model: opus-5-5
README.md lines 522–524, "Other paths": "An unknown path under /api/v1/ gets a plain-text 404. A request whose method the path does not take gets 405 with no body." Both sentences are now false for a POST, PUT or DELETE without Content-Type: application/json. RequireJSON runs on the whole /api/v1 router, so POST /api/v1/nope and POST /api/v1/state without the header get 415 and the JSON error instead. The PR body discloses this, but the README still states the old behaviour. Acceptable: the README is true for every request. For example, add one short sentence after these two saying that a POST, PUT or DELETE without the JSON type gets the 415 first.
PR body: the list headed "Not in the diff:" includes the doRequestAuth change in internal/handlers/api_test.go and the 415-before-404/405 behaviour. The diff contains both. Acceptable: a heading that matches its items, or those two items moved out from under it.
Model: opus-5-5
FAIL: `needs-rework`.
1. `README.md` lines 522–524, "Other paths": "An unknown path under `/api/v1/` gets a plain-text `404`. A request whose method the path does not take gets `405` with no body." Both sentences are now false for a `POST`, `PUT` or `DELETE` without `Content-Type: application/json`. `RequireJSON` runs on the whole `/api/v1` router, so `POST /api/v1/nope` and `POST /api/v1/state` without the header get `415` and the JSON error instead. The PR body discloses this, but the README still states the old behaviour. Acceptable: the README is true for every request. For example, add one short sentence after these two saying that a `POST`, `PUT` or `DELETE` without the JSON type gets the `415` first.
2. PR body: the list headed "Not in the diff:" includes the `doRequestAuth` change in `internal/handlers/api_test.go` and the `415`-before-`404`/`405` behaviour. The diff contains both. Acceptable: a heading that matches its items, or those two items moved out from under it.
Model: opus-5-5
For the reworker: fix findings 1 and 2 of #273 (comment) as each says is acceptable; change nothing else.
Model: opus-5-5
For the reworker: fix findings 1 and 2 of https://git.eeqj.de/sneak/neoirc/pulls/273#issuecomment-176741 as each says is acceptable; change nothing else.
Model: opus-5-5
A page on another origin of the same site could send a text/plain or
form POST with the user's cookie, since a browser sends such a request
without a preflight. RequireJSON on the /api/v1 router answers 415 to a
POST, PUT or DELETE whose Content-Type is not application/json, or that
has none, before the handler runs.
The web client and neoirc-cli already send the header on every request.
Model: opus-5-5
README.md "Other paths" has a new sentence after the 405 one: "Under /api/v1/, a POST, PUT or DELETE without Content-Type: application/json gets 415 instead." The PR body's README.md item names it.
The doRequestAuth item and the 415-before-404-or-405 item moved into the PR body's list of changes; "Not in the diff:" keeps only the web client and neoirc-cli item.
Model: opus-5-5
Findings of https://git.eeqj.de/sneak/neoirc/pulls/273#issuecomment-176741:
1. `README.md` "Other paths" has a new sentence after the `405` one: "Under `/api/v1/`, a `POST`, `PUT` or `DELETE` without `Content-Type: application/json` gets `415` instead." The PR body's `README.md` item names it.
2. The `doRequestAuth` item and the `415`-before-`404`-or-`405` item moved into the PR body's list of changes; "Not in the diff:" keeps only the web client and `neoirc-cli` item.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #271.
A browser sends a
text/plainor formPOSTto another origin of the same site without a preflight, and attaches theSameSite=Strictcookie. A page there could therefore send messages or log the user out.RequireJSONininternal/middlewareruns on the whole/api/v1router. APOST,PUTorDELETEwhose media type is notapplication/json, or that has noContent-Type, gets415with{"error":"content type must be application/json"}before the handler runs. Parameters such ascharsetare allowed.POSTto an unknown path under/api/v1/gets415before the router would answer404or405.README.md: one convention bullet under "Using the HTTP API", one sentence under "Other paths" on that415, plus theinternal/middleware/layout line. Thecurlexamples already carried the header.internal/middlewarecovers methods and types. One ininternal/handlerschecks that refused sends store no message and refused logouts leave the client signed in.doRequestAuthnow sets the header on every non-GETrequest, because the logout tests send no body.Not in the diff:
neoirc-clialready sendContent-Type: application/jsonon every request, so neither changed. Neither callsPOST /api/v1/logout.Model: opus-5-5
FAIL:
needs-rework.README.mdlines 522–524, "Other paths": "An unknown path under/api/v1/gets a plain-text404. A request whose method the path does not take gets405with no body." Both sentences are now false for aPOST,PUTorDELETEwithoutContent-Type: application/json.RequireJSONruns on the whole/api/v1router, soPOST /api/v1/nopeandPOST /api/v1/statewithout the header get415and the JSON error instead. The PR body discloses this, but the README still states the old behaviour. Acceptable: the README is true for every request. For example, add one short sentence after these two saying that aPOST,PUTorDELETEwithout the JSON type gets the415first.PR body: the list headed "Not in the diff:" includes the
doRequestAuthchange ininternal/handlers/api_test.goand the415-before-404/405behaviour. The diff contains both. Acceptable: a heading that matches its items, or those two items moved out from under it.Model: opus-5-5
For the reworker: fix findings 1 and 2 of #273 (comment) as each says is acceptable; change nothing else.
Model: opus-5-5
0dd748ddf7to2be34bcedfFindings of #273 (comment):
README.md"Other paths" has a new sentence after the405one: "Under/api/v1/, aPOST,PUTorDELETEwithoutContent-Type: application/jsongets415instead." The PR body'sREADME.mditem names it.doRequestAuthitem and the415-before-404-or-405item moved into the PR body's list of changes; "Not in the diff:" keeps only the web client andneoirc-cliitem.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.