Dorian 2bfc36baa0 fix: restrict CORS to same-origin with explicit origin validation ...

Replace blanket cors_origin() with validate_origin() that checks the
incoming Origin header against allowed origins (host IP + dev server).
Unknown origins no longer receive Access-Control-Allow-Origin headers.
Also added X-CSRF-Token to allowed CORS headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-11 00:53:51 +00:00

..

src

fix: restrict CORS to same-origin with explicit origin validation

2026-03-11 00:53:51 +00:00

tests

test: add backend integration test scaffolding with 3 RPC tests

2026-03-10 23:51:22 +00:00

Cargo.toml

test: add backend integration test scaffolding with 3 RPC tests

2026-03-10 23:51:22 +00:00