clawbot 1d707c9768 Accept only an origin written exactly as a browser sends it (closes #61) ...

access_control_allow_origin is now "*", or http or https, a host that is
an IP address as net/netip writes it (IPv6 in brackets) or a lowercase
host name whose last part contains a letter, and an optional port 1-65535
with no leading zero that is not the scheme's default. The value must
equal the origin rebuilt from those parts; anything else aborts startup
naming the key, its variable and the value. README.md and
config.example.yml say an origin is scheme, host and optional port,
exactly as the browser sends it.

Model: opus-5-5

2026-09-28 20:25:42 +00:00

..

blocked_networks_internal_test.go

feat: blocked_networks config and extended SSRF ranges (closes #67)

2026-09-22 00:43:27 +02:00

cache_max_bytes_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

cachesize.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

config_validation_internal_test.go

Test that origins a browser does not send abort startup (closes #61)

2026-09-28 20:24:12 +00:00

config.go

Accept only an origin written exactly as a browser sends it (closes #61)

2026-09-28 20:25:42 +00:00

env_internal_test.go

Test four README settings pixa does not have yet (closes #61)

2026-09-28 19:51:14 +00:00

trusted_proxies_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00