clawbot c75e942da8 Expect a Content-Security-Policy without unsafe-inline ...

The security headers test now expects script-src and style-src to
allow only 'self', and checks that the policy carries no
'unsafe-inline' at all. It fails until the login and generator pages
stop needing inline script and style.

Model: opus-5-5

2026-10-04 16:37:07 +00:00

..

client_ip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

middleware_internal_test.go

Expect a Content-Security-Policy without unsafe-inline

2026-10-04 16:37:07 +00:00

middleware.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00