d2fea6d789
Browsers send "simple" POSTs (text/plain, form encodings) without a CORS preflight, so a malicious page could execute side-effectful RPCs blind — the response stays unreadable cross-origin, but session.prompt would still run. The carrier now answers 415 unless the declared media type is application/json, forcing every cross-site attempt into a preflight this server never answers. Raw-fetch specs gain the header; a new handler case proves the fence rejects before the impl runs. |
||
|---|---|---|
| .. | ||
| api-proxy-cold.spec.ts | ||
| api-proxy-commands.spec.ts | ||
| api-proxy-models.spec.ts | ||
| api-proxy-view.spec.ts | ||
| api-proxy-workspace.spec.ts | ||
| client-handler.spec.ts | ||
| fetch-carrier.spec.ts | ||
| native-directory-picker.spec.ts | ||
| rpc-schemas.spec.ts | ||