sneak 1e77b8d4f2 Name the cause on the page for a refused form (closes #358) ...

The CSRF middleware answered a refused login or generator form with the
library's bare text, such as "Forbidden - origin invalid". It now answers
403 with a page that names the cause and what to do, and logs a warning
with the request ID and the library's reason. A page opened over plain
HTTP with debug off and a form from another host both fail the origin
check; the page tells them apart by the host in the Origin or Referer
header.

Model: opus-5-5

2026-11-11 21:30:01 +00:00

..

allowlist

Remove the code nothing in production calls (closes #312)

2026-10-26 10:54:14 +01:00

app

Test that pixad writes only its own errors to stderr (closes #359)

2026-11-11 22:26:52 +01:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Load every setting from one table in internal/config (closes #320)

2026-10-26 22:32:03 +01:00

database

Build the image pipeline in pixad's fx graph (closes #313)

2026-10-26 12:28:23 +01:00

db/migrations

Check cached sources with upstream after the cache TTL (closes #69) (#350)

2026-11-11 13:37:15 +01:00

encurl

Derive every key from the signing key in one place (closes #315)

2026-10-26 14:10:20 +01:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Name the cause on the page for a refused form (closes #358)

2026-11-11 21:30:01 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Check cached sources with upstream after the cache TTL (closes #69) (#350)

2026-11-11 13:37:15 +01:00

imageprocessor

Detect a fetched image's format from its bytes once (closes #319)

2026-10-26 21:21:39 +01:00

imageproxy

Delete a negative-cache test that tests nothing (closes #347)

2026-11-11 16:56:21 +01:00

imagerequest

Detect a fetched image's format from its bytes once (closes #319)

2026-10-26 21:21:39 +01:00

imgcache

Export cache, eviction, upstream and transform metrics (closes #85)

2026-11-11 14:32:38 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Detect a fetched image's format from its bytes once (closes #319)

2026-10-26 21:21:39 +01:00

middleware

Label request metrics with standard HTTP methods only (closes #274)

2026-10-15 21:47:11 +02:00

providers

Export cache, eviction, upstream and transform metrics (closes #85)

2026-11-11 14:32:38 +00:00

seal

Derive every key from the signing key in one place (closes #315)

2026-10-26 14:10:20 +01:00

server

Split internal/imgcache into the image proxy and the cache (closes #317)

2026-10-26 20:00:25 +01:00

session

Derive every key from the signing key in one place (closes #315)

2026-10-26 14:10:20 +01:00

signature

Take the signature, the expiry and the URL scheme off the image request (closes #314)

2026-10-26 13:49:12 +01:00

static

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

templates

Name the cause on the page for a refused form (closes #358)

2026-11-11 21:30:01 +00:00