Repository navigation

Harden HTTP endpoints against cross-site requests and XSS - #170

Merged

wimaha merged 4 commits into

mainfrom

security/hardening

Oct 18, 2026

Merged

Harden HTTP endpoints against cross-site requests and XSS#170
wimaha merged 4 commits into
mainfrom
security/hardening

Commits on Oct 18, 2026
- Harden HTTP endpoints against cross-site requests and XSS
  
  wimaha
  and
  claude
  committed
  e163933
- Test cross-site protection and escaping end to end against the simulated car
  
  wimaha
  and
  claude
  committed
  ec8fe27
- Add trustedOrigins for reverse proxies; document POST-only key routes
  
  wimaha
  and
  claude
  committed
  31dfc21
- Normalize trustedOrigins; document 403 for browser clients on other origins
  
  wimaha
  and
  claude
  committed
  e1f0da1