The session cookie is scoped to the parent domain and is SameSite=Lax, and
every *.parodia.dev host is the same site as Pete as far as Lax is concerned.
So a form on any sibling subdomain could post a bet, a mischief order or an
equip change and the browser would attach whoever's signed-in cookie to it.
Nothing on the server looked at where a request came from.
The whole handler now sits behind http.NewCrossOriginProtection. It reads
Sec-Fetch-Site (falling back to Origin against Host) and refuses a
state-changing request from any other origin with a 403. GETs are untouched,
and so is anything that carries neither header, which is exactly what
gogobee's bearer-token calls from Go look like.
prosolis
4eaf8ae366