cjkas 0ee52d6d9f fix: close the token bypass below a route, review fixes for 4b ... The routes matched any path below them, and a web asset name there passed the token check: GET /backup/a.js returned the backup under Secured. Every route is now an exact match, and a web asset sits in the root only. - e2e: those paths answer 401 or 404; the restore test now fails when the chunks skip the token check (checked with the check removed). - WEB_CORS lets the socket take Origin: null instead of skipping the Origin check. - ADR 0006, GLOSSARY and README: the Origin check in either mode, /ws as a public route, the Host header behind a reverse proxy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-28 19:39:51 +01:00
..
adr	fix: close the token bypass below a route, review fixes for 4b	2026-10-28 19:39:51 +01:00
KNOWN_ISSUES.md	feat!: remove the old API, ports 8081 and 8080 (step 4a)	2026-10-27 21:49:38 +01:00
NICE_TO_HAVE.md	docs: add agent testing instructions and the RMT transmit idea	2026-10-16 09:11:17 +02:00
PROTOCOL.md	feat!: the token on every route, Secure Config Only goes (step 4b)	2026-10-27 23:03:59 +01:00
SECURITY_PLAN.md	fix: close the token bypass below a route, review fixes for 4b	2026-10-28 19:39:51 +01:00