David Gageot ca4254f2d8 fix: lock down REST session API against CSRF and DNS rebinding ...

Require --auth-token on non-loopback listeners, enforce JSON
content-type and origin checks on every method (not just mutations),
and add --remote-auth-token so `run --remote` can talk to a
token-protected listener.

Assisted-By: docker-agent

2026-10-18 19:31:55 +02:00

..

root

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

wasm

test: make Gemini integration fixtures reviewer-only

2026-10-16 14:58:00 +00:00