probo

Files

Bryan Frimin ea21f85887 Add http.CrossOriginProtection for CSRF defense using Sec-Fetch-Site headers

Implements native Go 1.26 cross-origin protection to block state-changing cross-origin browser requests. Registers configured AllowedOrigins as trusted origins and wraps the API router to check all incoming requests. Non-browser clients (MCP, Slack webhooks) are unaffected as they lack the browser-only Sec-Fetch-Site header.

Signed-off-by: gearnode <gearnode@probo.inc>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>

2026-03-19 09:31:52 +01:00

authn

Fix race condition in magic link token verification and typo in auth error message

2026-03-19 09:31:15 +01:00

authz

Return proper error not found during deletion

2026-03-04 08:54:02 +01:00

compliancepage

Remove deadcode

2026-03-13 17:18:02 +01:00

connect/v1

Stop tracking generated files