dev_agentandClaude Opus 5.5 cf598a8405 Validate API paths against the page origin, not a placeholder ...

The guard resolved paths against a fixed placeholder origin, so
//same-origin.invalid/api/v1/me passed and fetch sent the CSRF token to
that host. apiFetch now resolves against location.origin, refuses
anything off that origin or outside /api/v1/, and fetches the validated
path-absolute URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-04 08:59:51 -04:00

..

scripts

Feature 05 task 1: Design tokens and self-hosted fonts (#32)

2026-10-03 16:16:25 -04:00

src

Validate API paths against the page origin, not a placeholder

2026-10-04 08:59:51 -04:00

index.html

Feature 01 task 2: Vite React TypeScript web skeleton (#3)

2026-10-02 22:26:34 -04:00

package-lock.json

Photo and Icon components (#37)

2026-10-03 18:29:16 -04:00

package.json

Restrict apiFetch to same-origin /api/v1/ and lint colours in the build

2026-10-04 08:52:44 -04:00

tsconfig.json

Feature 01 task 2: Vite React TypeScript web skeleton (#3)

2026-10-02 22:26:34 -04:00

vite.config.ts

Feature 05 task 2: Core UI primitives (#34)

2026-10-03 16:34:59 -04:00