clawbot 432342e963 Stop allowing credentialed cross-origin requests (closes #261) ...

CORS() allowed every origin with credentials, so a page on another
origin of the same site could read what the signed-in user sees. It
now uses the options of the CONVENTIONS.md template: every origin as
*, no credentials, and the template's request headers. corsMaxAge
stays, since AGENTS.md asks for named constants.

Model: opus-5-5

2026-11-10 22:25:40 +00:00

..

middleware_test.go

Honour forwarded headers only from trusted proxies (closes #259)

2026-11-10 22:41:50 +01:00

middleware.go

Stop allowing credentialed cross-origin requests (closes #261)

2026-11-10 22:25:40 +00:00