6 Commits
Author SHA1 Message Date
Trong Huu Nguyen 0d6d4a0dff fix(http): encode the unauthenticated response as JSON
The response was built by concatenating the request path into a JSON
string. The path is percent-decoded, so it can contain quotes and
backslashes, which produced malformed JSON and let a caller inject
arbitrary keys into the object.
2026-07-28 11:43:54 +02:00
Trong Huu Nguyen c56625d842 fix: check or explicitly ignore returned errors
Satisfies errcheck. Errors that carry no actionable information are
ignored explicitly: writes to an already-committed response, and closing
a fully read response body or file.

Test fixture setup asserts with require.NoError instead, since a failure
there means the fixture itself is broken.
2026-07-28 09:04:59 +02:00
Trong Huu Nguyen 126db31d25 feat: restrict non-navigational requests to oauth2-routes for all modes 2025-04-02 11:53:29 +02:00
Trong Huu Nguyen 2e8c7075ff fix: set content-type header before status 2025-02-03 11:38:35 +01:00
Trong Huu Nguyen ed02b782fe refactor(http): inline navigation check in middleware 2025-02-03 08:41:59 +01:00
Trong Huu Nguyen 4b1bdef5cd feat: disallow non-navigational requests to login and logout endpoints 2025-01-31 16:42:24 +01:00