cjkas 0ee52d6d9f fix: close the token bypass below a route, review fixes for 4b ... The routes matched any path below them, and a web asset name there passed the token check: GET /backup/a.js returned the backup under Secured. Every route is now an exact match, and a web asset sits in the root only. - e2e: those paths answer 401 or 404; the restore test now fails when the chunks skip the token check (checked with the check removed). - WEB_CORS lets the socket take Origin: null instead of skipping the Origin check. - ADR 0006, GLOSSARY and README: the Origin check in either mode, /ws as a public route, the Host header behind a reverse proxy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-28 19:39:51 +01:00
..
0001-local-nvs-handles-no-wrapper.md	fix: give every NVS user its own Preferences handle	2026-10-12 20:51:05 +02:00
0002-loop-task-is-the-only-writer-of-the-shade-model.md	fix: review fixes for step 4a	2026-10-27 22:11:54 +01:00
0003-pioarduino-idf55.md	build: move to pioarduino 55.03.312 (Arduino 3.3.12, ESP-IDF 5.5)	2026-10-19 22:05:22 +02:00
0005-one-websocket-protocol.md	fix: web UI client review findings (step 2a)	2026-10-25 18:04:07 +01:00
0006-two-security-modes-eleven-http-routes.md	fix: close the token bypass below a route, review fixes for 4b	2026-10-28 19:39:51 +01:00
0007-no-github-update.md	docs: ADRs 0005-0007 for socket protocol 2	2026-10-22 20:50:33 +02:00