Ettore Di Giacinto 66e5407c88 fix(addons): accept same-host browser requests that carry no fetch metadata ...

Browsers do not send Sec-Fetch-* headers over plain HTTP on an address
that is not localhost, so every add-on request from a LAN address was
refused as cross-site. Keep refusing a Sec-Fetch-Site value other than
same-origin. When the header is absent, accept the request only if its
Origin, or failing that its Referer, names the same host and port as
the request.

Assisted-by: Claude Code:claude-sonnet-5-5 go
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-20 20:54:44 +00:00

..

apps_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

apps.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

artifacts_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

artifacts.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

assets_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

assets.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

browserguard_test.go

fix(addons): accept same-host browser requests that carry no fetch metadata

2026-10-20 20:54:44 +00:00

builtin_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

builtin.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

catalogui_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

forwarding_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

gateway_auth_test.go

fix(addons): keep API keys off recovery mutations and same-site cookies

2026-10-20 20:54:43 +00:00

gateway_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

gateway.go

fix(addons): accept same-host browser requests that carry no fetch metadata

2026-10-20 20:54:44 +00:00

installrefusal_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

pins_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

pins.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

proposals_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

proposals.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

recovery.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

resources.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

resulterror_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

routes_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

tools_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

updates_test.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

updates.go

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00