clawbot 3587ce92cd Stop allowing cross-origin requests (closes #261) ...

The CORS middleware let every origin make credentialed requests, so a
page on another subdomain of the server's domain could read and act as
the signed-in user. Nothing needs cross-origin access, so the
middleware and the go-chi/cors dependency go. A test checks that a
request from another origin and a preflight get no
Access-Control-Allow-* headers.

Model: opus-5-5

2026-11-10 21:50:10 +00:00

..

export_test.go

Start test servers on a port the system picks (closes #211)

2026-10-27 13:34:45 +01:00

http.go

MVP: IRC envelope format, long-polling, per-client queues, SPA rewrite

2026-02-26 20:16:11 -08:00

routes_test.go

Serve the index page for an empty URL path instead of panicking (closes #149)

2026-10-20 21:31:26 +02:00

routes.go

Stop allowing cross-origin requests (closes #261)

2026-11-10 21:50:10 +00:00

server_test.go

Stop allowing cross-origin requests (closes #261)

2026-11-10 21:50:10 +00:00

server.go

Start test servers on a port the system picks (closes #211)

2026-10-27 13:34:45 +01:00