sneak 0dd748ddf7 Refuse API writes that are not application/json (closes #271) ...

A page on another origin of the same site could send a text/plain or
form POST with the user's cookie, since a browser sends such a request
without a preflight. RequireJSON on the /api/v1 router answers 415 to a
POST, PUT or DELETE whose Content-Type is not application/json, or that
has none, before the handler runs.

The web client and neoirc-cli already send the header on every request.

Model: opus-5-5

2026-11-11 00:34:16 +00:00

..

api_test.go

Refuse API writes that are not application/json (closes #271)

2026-11-11 00:34:16 +00:00

api.go

Honour forwarded headers only from trusted proxies (closes #259)

2026-11-10 22:41:50 +01:00

auth.go

Apply MAX_MESSAGE_SIZE to the whole request body (closes #250)

2026-11-03 09:20:42 +01:00

export_test.go

Stop the slow test packages waiting (closes #263)

2026-11-11 01:15:43 +01:00

handlers.go

Apply MAX_MESSAGE_SIZE to the whole request body (closes #250)

2026-11-03 09:20:42 +01:00

healthcheck.go

feat: add runtime statistics to healthcheck endpoint (#80)

2026-03-17 12:43:39 +01:00

utility_test.go

Run the internal/handlers tests in parallel (closes #194)

2026-10-27 08:28:28 +01:00

utility.go

Compare nicks by exact case everywhere (closes #128)

2026-10-20 16:31:28 +02:00