clawbot 3d008b3017 Remove unsafe-inline from the Content-Security-Policy (closes #125) ...

script-src and style-src now allow only 'self'. The generator page's
two inline onclick handlers, which selected the generated URL and
copied it, move into internal/static/generator.js and are attached
with addEventListener. The bundled Tailwind script, which built styles
in the browser and injected them at runtime, is replaced by a small
hand-written internal/static/style.css holding only the rules the
login and generator pages use; the templates carry a few plain class
names in place of Tailwind's. No build step. The pages keep their
layout, not every pixel of it.

Model: opus-5-5

2026-10-04 16:37:07 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

Expect a Content-Security-Policy without unsafe-inline

2026-10-04 16:37:07 +00:00

middleware.go

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 16:37:07 +00:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00