ryan f6f8c25930 fix(router): restrict CORS origin reflection to allowed hosts (AUTH-ROUTE-5) ...

- Extract isOriginAllowed helper to match Origin against server_address configurations
- Ensure arbitrary origins are not reflected and credentials are not allowed when server_address is unconfigured or mismatched
- Trim trailing slashes from allowed origins configuration for robust matching
- Add TestCORSMiddleware to cover all CORS matching and rejection scenarios

2026-06-13 10:23:20 +08:00

..

custom.go

更新示例

2026-06-10 15:11:42 +08:00

frontend_embedded.go

精简

2026-06-10 11:33:33 +08:00

frontend.go

精简

2026-06-10 11:33:33 +08:00

middlewares_test.go

fix(router): restrict CORS origin reflection to allowed hosts (AUTH-ROUTE-5)

2026-06-13 10:23:20 +08:00

middlewares.go

fix(router): restrict CORS origin reflection to allowed hosts (AUTH-ROUTE-5)

2026-06-13 10:23:20 +08:00

router.go

fix(oauth): secure OAuth state session binding to prevent account takeover

2026-06-13 09:55:07 +08:00