Ettore Di Giacinto 45fb4e57e7 fix(addons): accept a same-host Referer or Origin for human confirmation ...

Browsers send no Sec-Fetch-* headers over plain HTTP on an address that
is not localhost, so creating a resource from a LAN address failed with
"Creating a resource requires your own browser session".

When Sec-Fetch-Site is present it must still be same-origin with an
empty destination, as before. When it is absent, Origin or, failing
that, Referer must name the request host and port. A destination or
mode that is present must still be the expected one. This matches the
rule in BrowserProtection. The credential, token cookie, API key and
tool-context checks are unchanged.

Assisted-by: Claude Code:claude-sonnet-5-5 go
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-21 14:01:26 +00:00

..

addons

fix(addons): accept a same-host Referer or Origin for human confirmation

2026-10-21 14:01:26 +00:00

anthropic

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

elevenlabs

fix(sound): enumerate expansion keys (#12787)

2026-10-20 13:14:49 +02:00

explorer

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

jina

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

localai

test(addons): move the remaining add-on tests to Ginkgo

2026-10-21 02:20:12 +00:00

mcp

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

ollama

fix(ollama): report on-disk size for /api/tags and /api/ps (#11989)

2026-09-28 00:11:41 +02:00

openai

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00

openresponses

feat(addons): add the add-on runtime, navigation and first-party add-ons

2026-10-20 20:54:43 +00:00