clawbot 8314099abd Refuse image requests whose Referer is on referer_blocklist (closes #90) ...

A new setting, referer_blocklist (PIXA_REFERER_BLOCKLIST), lists hosts
whose pages may not show pixa's images. Entries are written and matched
as allowlist_hosts are, with the same matcher. Both image routes check
the Referer before the signature, the cache and the upstream fetch, and
answer 403 with the JSON error, so a blocked request costs nothing and
is refused whether or not the image is cached. No Referer, or one that
does not parse, is served; README.md says this makes the list easy to
get around. An entry of either host list that is not a host name
(letters, digits, hyphens, underscores, dots, at most one leading dot)
or an IP address now aborts startup naming the setting and the entry.

Model: opus-5-5

2026-10-04 22:24:50 +02:00

..

Caddyfile

Write the deployment guide and an example Caddy config (closes #89)

2026-10-04 15:08:03 +02:00

config.example.yml

Refuse image requests whose Referer is on referer_blocklist (closes #90)

2026-10-04 22:24:50 +02:00