clawbot 9c8b70ed36 Stop allowing credentialed cross-origin requests (closes #261) ...

CORS() allowed every origin with credentials, so a page on another
origin of the same site could read what the signed-in user sees. It
now uses the options of the CONVENTIONS.md template: every origin as
*, no credentials. It applies only to GET /api/v1/server and
GET /.well-known/healthcheck.json, the public read-only routes, since
REPO_POLICIES.md forbids * on authenticated routes. Every other route
sends no Access-Control-Allow-* header.

Model: opus-5-5

2026-11-10 23:13:19 +00:00

..

middleware_test.go

Honour forwarded headers only from trusted proxies (closes #259)

2026-11-10 22:41:50 +01:00

middleware.go

Stop allowing credentialed cross-origin requests (closes #261)

2026-11-10 23:13:19 +00:00