ericanannn-blip 3051aebb28 fix(middleware): log rejected CSRF requests with the trusted client address (#6692) ...

A panel or API request rejected for a missing or wrong CSRF token got a bare
403 and left nothing in the log, so an operator chasing failed logins from a
stale tab or a script had no trace. CSRFMiddleware now logs a warning with the
method, path and client address. The address comes from getRemoteIp, which
honours the trusted-proxy list, instead of gin's ClientIP, which trusts any
peer's X-Forwarded-For.

2026-10-24 04:51:21 +02:00

..

bodylimit_test.go

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

bodylimit.go

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

config_envelope_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

config_envelope.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

domainValidator.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

security_test.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

security.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

validate_mutation_test.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

validate_protocol_test.go

fix(inbounds): accept masque in the inbound protocol validator

2026-10-11 10:56:47 +02:00

validate_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

validate.go

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00