validate client server origins

2026-10-25 06:57:31 +01:00
parent 313535fe70
commit aeae58d0d8
2 changed files with 28 additions and 6 deletions
@@ -4,3 +4,6 @@ Run formatting, linting, type checks, tests, and the AppImage build before submi
 The client uses Prettier for formatting and `svelte-check` for the lint/check
 gate. Run `npm run format:check`, `npm run lint`, `npm run check`, and
 `npm run build` before pushing changes.
+
+The server address is treated as untrusted input. Client requests accept only
+HTTP(S) origins without embedded credentials, query strings, or fragments.