David Gageot ca4254f2d8 fix: lock down REST session API against CSRF and DNS rebinding ...

Require --auth-token on non-loopback listeners, enforce JSON
content-type and origin checks on every method (not just mutations),
and add --remote-auth-token so `run --remote` can talk to a
token-protected listener.

Assisted-By: docker-agent

2026-10-18 19:31:55 +02:00

..

host_test.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

host.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

httpsec_test.go

refactor(httpsec): share HTTP auth and origin matchers

2026-08-18 14:09:57 +02:00

httpsec.go

refactor(httpsec): share HTTP auth and origin matchers

2026-08-18 14:09:57 +02:00