weichenandCursor 8eda35f365 Refuse open listeners and cross-site writes without auth ...

Why: The embedded tier starts without auth, and nothing checked Origin or Host, so a public bind or a foreign page could call write APIs.
Evidence: go test ./internal/config ./internal/server covering listen policy, origin rejection, and response headers.
Impact: Non-loopback without auth exits before opening the database. HTML artifacts get a sandbox CSP. Reverse proxies must list their public host in allowedHosts.
Refs: feature/sillytavern-review
Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-04 17:28:46 +00:00

..

main.go

Refuse open listeners and cross-site writes without auth

2026-10-04 17:28:46 +00:00