Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix(connection): hold markerless requests to the Host fence — plain-HTTP browser reads carry no markers

Browse Source 
Fetch-Metadata and Origin are only attached to trustworthy destinations, so
over plain HTTP a rebound page's same-origin GET (EventSource, images,
navigations) arrives with no browser markers and a readable response. Remove
the marker shortcut; non-browser clients pass the same fence via loopback,
the CLI-derived LAN IP literals, or a declared authority.
This commit is contained in:
creatixchu
2026-07-28 17:02:39 +08:00
parent 7ff8da56df
commit 772653464d
11 changed files with 45 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/client/connection/README.i18n.yaml
+2 -2
View File
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write packages/client/connection/README.md
README.md: 7e437e8fd81d1d57ead5ead64d2049111ad163dc
README.zh.md: 3615d5ea1be44e6da8e41fa17f645eb414d1ef3e
README.md: 173a9b9998e17d201b2d31d73ea74a94b319dae6
README.zh.md: ca5da643db443956c25399f07c8b460900942ad4