clawbot 4f9d48298b Expect a Content-Security-Policy without unsafe-inline ...

The security headers test now expects script-src and style-src to
allow only 'self', and checks that the policy carries no
'unsafe-inline' at all. It fails until the login and generator pages
stop needing inline script and style.

Model: opus-5-5

2026-10-04 15:59:34 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

Expect a Content-Security-Policy without unsafe-inline

2026-10-04 15:59:34 +00:00

middleware.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00