Linus Rath 0f0ebc906b fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)

2026-10-26 11:48:38 +01:00

..

app-frame-origins-client.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

app-frame-origins.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

ip-ranges.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

request-protocol.ts

fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)

2026-10-26 11:48:38 +01:00

same-origin.ts

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

url-guard.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00