sneak baa253b642 Name the cause on the page for a refused form (closes #358) ...

The CSRF middleware answered a refused login or generator form with the
library's bare text, such as "Forbidden - origin invalid". It now answers
403 with a page that names the cause and what to do, and logs a warning
with the request ID and the library's reason. A page opened over plain
HTTP with debug off and a form from another host both fail the origin
check; the page tells them apart by the host in the Origin or Referer
header.

Model: opus-5-5

2026-11-11 20:58:27 +00:00

..

form_refused.html

Name the cause on the page for a refused form (closes #358)

2026-11-11 20:58:27 +00:00

generator.html

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

login.html

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates.go

Add static files and HTML templates for web UI

2026-01-08 07:38:09 -08:00