Ettore Di Giacinto e7687e9fe9 fix(http): drop the global CSRF relaxation and CORS-derived socket origin ...

CSRFMiddlewareWithCORS changed CSRF handling for every route and, with a
wildcard allowlist, disabled the Sec-Fetch-Site check. Restore the
original CSRFMiddleware: clients that authenticate with validated header
credentials, or with a single-use WebSocket ticket, are already exempt,
so the motion routes need no relaxation.

The motion WebSocket upgrade no longer reads the CORS allowlist to
decide whether a cross-origin upgrade is acceptable. It accepts one only
with a valid ticket or validated header credentials; everything else
gets the same-origin default.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-13 08:27:24 +00:00

..

anthropic

feat(router): route with native decision models (#12449)

2026-10-04 09:34:21 +02:00

elevenlabs

feat(audio): add YuE2 music generation (#12617)

2026-10-11 00:26:10 +02:00

explorer

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

jina

feat(whisper): honor client cancellation via ggml abort_callback (#9710)

2026-05-08 01:44:47 +02:00

localai

fix(http): drop the global CSRF relaxation and CORS-derived socket origin

2026-10-13 08:27:24 +00:00

mcp

fix(mcp): check token expiry after failed refresh

2026-10-13 08:08:26 +00:00

ollama

fix(ollama): report on-disk size for /api/tags and /api/ps (#11989)

2026-09-28 00:11:41 +02:00

openai

feat(images): add ESRGAN upscaling and Studio workflow (#12620)

2026-10-11 00:30:09 +02:00

openresponses

refactor(distributed): put the NATS-only paths behind interfaces (#12395)

2026-10-02 23:58:41 +02:00