creatixchu 772653464d fix(connection): hold markerless requests to the Host fence — plain-HTTP browser reads carry no markers ...

Fetch-Metadata and Origin are only attached to trustworthy destinations, so
over plain HTTP a rebound page's same-origin GET (EventSource, images,
navigations) arrives with no browser markers and a readable response. Remove
the marker shortcut; non-browser clients pass the same fence via loopback,
the CLI-derived LAN IP literals, or a declared authority.

2026-07-28 17:02:39 +08:00

6.7 KiB

Raw Blame History

View Raw