sneak fe3a32c63d Test that logging out needs the form's CSRF token (part of #256) ...

A GET /logout, or a POST /logout without the CSRF token, must end no
login session; the generator page must carry a logout form with the
token; and after a logout from that form, a login opens the generator
page while a cookie copied before it is refused, also after a restart.

Model: opus-5-5

2026-10-15 13:55:25 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Allowlist no host in the example config (closes #249)

2026-10-15 06:26:23 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Logging out ends every login session (closes #256)

2026-10-15 13:49:36 +00:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Test that logging out needs the form's CSRF token (part of #256)

2026-10-15 13:55:25 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

imgcache

Remove expired negative cache rows in the eviction loop (closes #244)

2026-10-15 15:02:27 +02:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Test that logging out needs the form's CSRF token (part of #256)

2026-10-15 13:55:25 +00:00

session

Test that logging out needs the form's CSRF token (part of #256)

2026-10-15 13:55:25 +00:00

signature

Escape : and % in the signed and cached path and query (closes #247)

2026-10-15 09:37:01 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00