routewatch

211 Commits 5 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	6e4b41c09f	Show the IP information API on the home page (closes #156 ) check / check (push) Canceled after 0s Details The home page gets an IP information API card. It shows the curl command that asks /ip/ about the visitor's own address. The page then makes that same request and shows the JSON answer, pretty-printed. An error answer, such as a 404 for an address with no route, is shown the same way. A request that fails shows an error line. The server gives the page the visitor's address, found as /ip/ finds it, so a trusted proxy's X-Forwarded-For is honoured. The command takes its origin from the browser, so it names the host the visitor used. Model: opus-5-5	2026-10-27 04:03:33 +00:00
clawbot	f489321e3a	Answer HEAD requests and give 405 a plain message (closes #111 ) check / check (push) Canceled after 0s Details Every route was registered for GET only, so HEAD answered 405, and on the JSON routes that 405 said "Internal server error". chi's GetHead now serves HEAD with the GET handler; /ip and /ip/ register HEAD themselves, as GetHead does not reach them. The /api/v1 and /ip route groups answer a path they lack with a JSON 404 "Not found", and the other methods the router knows (POST, PUT, PATCH, DELETE, OPTIONS, TRACE, CONNECT) with a JSON 405 "Method not allowed" whose Allow header names GET and HEAD. JSONValidationMiddleware gives a 4xx sent without a JSON body the status's standard text instead of "Internal server error". Model: opus-5-5	2026-10-20 03:06:23 +02:00
clawbot	89bdda18a5	Add the HTTP hardening the policy requires before 1.0 (closes #108 ) check / check (push) Canceled after 0s Details Every answer carries the six security headers REPO_POLICIES.md lists. The Content-Security-Policy allows inline content only with a nonce made for that answer; the pages put it on their style and script blocks and drop their four style attributes. The request log and /ip/ take a forwarded address only from a proxy listed in TRUSTED_PROXIES, which stops the start when set but invalid: the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP and True-Client-IP are no longer read. The JSON routes and the health check send fixed messages in place of database, parser and resolver errors, and log the detail. Model: opus-5-5	2026-10-20 01:36:18 +02:00

Author

SHA1

Message

Date

clawbot

6e4b41c09f

Show the IP information API on the home page (closes #156 )

check / check (push) Canceled after 0s

Details

The home page gets an IP information API card. It shows the curl
command that asks /ip/ about the visitor's own address. The page then
makes that same request and shows the JSON answer, pretty-printed. An
error answer, such as a 404 for an address with no route, is shown the
same way. A request that fails shows an error line.

The server gives the page the visitor's address, found as /ip/ finds
it, so a trusted proxy's X-Forwarded-For is honoured. The command takes
its origin from the browser, so it names the host the visitor used.

Model: opus-5-5

2026-10-27 04:03:33 +00:00

clawbot

f489321e3a

Answer HEAD requests and give 405 a plain message (closes #111 )

check / check (push) Canceled after 0s

Details

Every route was registered for GET only, so HEAD answered 405, and on
the JSON routes that 405 said "Internal server error". chi's GetHead
now serves HEAD with the GET handler; /ip and /ip/ register HEAD
themselves, as GetHead does not reach them. The /api/v1 and /ip route
groups answer a path they lack with a JSON 404 "Not found", and the
other methods the router knows (POST, PUT, PATCH, DELETE, OPTIONS,
TRACE, CONNECT) with a JSON 405 "Method not allowed" whose Allow header
names GET and HEAD. JSONValidationMiddleware gives a 4xx sent without a
JSON body the status's standard text instead of "Internal server error".

Model: opus-5-5

2026-10-20 03:06:23 +02:00

clawbot

89bdda18a5

Add the HTTP hardening the policy requires before 1.0 (closes #108 )

check / check (push) Canceled after 0s

Details

Every answer carries the six security headers REPO_POLICIES.md lists.
The Content-Security-Policy allows inline content only with a nonce made
for that answer; the pages put it on their style and script blocks and
drop their four style attributes.

The request log and /ip/ take a forwarded address only from a proxy
listed in TRUSTED_PROXIES, which stops the start when set but invalid:
the last X-Forwarded-For entry that is not a trusted proxy. X-Real-IP
and True-Client-IP are no longer read.

The JSON routes and the health check send fixed messages in place of
database, parser and resolver errors, and log the detail.

Model: opus-5-5

2026-10-20 01:36:18 +02:00