sneak 589318db97 Read the source host's port from the parsed URL (part of #246) ...

net.SplitHostPort fails on an IPv6 address written without brackets,
so with 2001:db8::1 allowlisted, 2001:db8::1:8443 and 2001:db8::1:
counted as having no port and were served without a signature, though
the fetcher connects to port 8443. ValidateRequest now takes a host to
have a port when the parsed URL's Port() is set or the host ends in
":", as Go's URL parser and so the fetcher read it.

Model: opus-5-5

2026-10-15 07:38:14 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Allowlist no host in the example config (closes #249)

2026-10-15 06:26:23 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Refuse a size whose computed side exceeds the maximum (closes #241)

2026-10-13 09:44:44 +02:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

imgcache

Read the source host's port from the parsed URL (part of #246)

2026-10-15 07:38:14 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

session

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

signature

Escape : and % in the signed and cached path and query (closes #247)

2026-10-15 09:37:01 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00