cjkas 0ee52d6d9f fix: close the token bypass below a route, review fixes for 4b ... The routes matched any path below them, and a web asset name there passed the token check: GET /backup/a.js returned the backup under Secured. Every route is now an exact match, and a web asset sits in the root only. - e2e: those paths answer 401 or 404; the restore test now fails when the chunks skip the token check (checked with the check removed). - WEB_CORS lets the socket take Origin: null instead of skipping the Origin check. - ADR 0006, GLOSSARY and README: the Origin check in either mode, /ws as a public route, the Host header behind a reverse proxy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-28 19:39:51 +01:00
..
test_main.cpp	fix: close the token bypass below a route, review fixes for 4b	2026-10-28 19:39:51 +01:00