probo

Files

Bryan Frimin ea21f85887 Add http.CrossOriginProtection for CSRF defense using Sec-Fetch-Site headers

Implements native Go 1.26 cross-origin protection to block state-changing cross-origin browser requests. Registers configured AllowedOrigins as trusted origins and wraps the API router to check all incoming requests. Non-browser clients (MCP, Slack webhooks) are unaffected as they lack the browser-only Sec-Fetch-Site header.

Signed-off-by: gearnode <gearnode@probo.inc>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>

2026-03-19 09:31:52 +01:00

api

Add http.CrossOriginProtection for CSRF defense using Sec-Fetch-Site headers

2026-03-19 09:31:52 +01:00

gqlutils

Fix race condition in magic link token verification and typo in auth error message

2026-03-19 09:31:15 +01:00

mailactions

Autosubmit mailing list confirmation

2026-03-12 15:28:03 +01:00

statichandler

Remove deadcode