sneak d3d3b47cf4 Reports are taken only as application/json (closes #126) ...

A page on another origin can POST text/plain or a form without a CORS
preflight, so its visitors' browsers could store reports although the
server sends no CORS headers. decodeJSON now refuses a request whose
Content-Type is not application/json (parameters such as charset
allowed), and the report handler answers it 415 with the usual error
body, storing nothing. A JSON POST waits for the preflight, which only
an origin in CORS_ALLOWED_ORIGINS passes; the page already sends
application/json.

Model: opus-5-5

2026-10-14 10:05:20 +00:00

..

export_test.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

http_test.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

http.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

routes_test.go

Reports are taken only as application/json (closes #126)

2026-10-14 10:05:20 +00:00

routes.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00

server.go

Move to the layout REPO_POLICIES.md gives (closes #30)

2026-10-14 12:01:32 +02:00