prosolis 4eaf8ae366 web: refuse writes that come from somebody else's page ...

The session cookie is scoped to the parent domain and is SameSite=Lax, and
every *.parodia.dev host is the same site as Pete as far as Lax is concerned.
So a form on any sibling subdomain could post a bet, a mischief order or an
equip change and the browser would attach whoever's signed-in cookie to it.
Nothing on the server looked at where a request came from.

The whole handler now sits behind http.NewCrossOriginProtection. It reads
Sec-Fetch-Site (falling back to Origin against Host) and refuses a
state-changing request from any other origin with a 403. GETs are untouched,
and so is anything that carries neither header, which is exactly what
gogobee's bearer-token calls from Go look like.

2026-09-22 22:54:38 -07:00

..

assets/fonts

games: the door you can see from outside, and the picture on it

2026-07-14 13:30:52 -07:00

static

games: the sit button that never looked twice, and the phrase that ran off the phone

2026-08-25 23:06:13 -07:00

templates

adventure: let a player back out from the web, not only in Matrix

2026-07-24 21:42:59 -07:00

adventure_art_test.go

adventure: give every dispatch a card that looks like what it is

2026-07-24 15:47:44 -07:00

adventure_art.go

adventure: give every dispatch a card that looks like what it is

2026-07-24 15:47:44 -07:00

adventure_digest.go

Adventure: stop signing my own posts

2026-07-12 22:01:12 -07:00

adventure_prose_test.go

adventure: publish gogobee's LLM prose, guarded, template as the net

2026-07-17 09:27:53 -07:00

adventure_retreat_test.go

Adventure: Pete learns the word "retreat"

2026-07-12 10:33:53 -07:00

adventure_test.go

adventure: stay out of the room when TwinBee already said it

2026-07-25 10:21:43 -07:00

adventure.go

adventure: stay out of the room when TwinBee already said it

2026-07-25 10:21:43 -07:00

auth_test.go

auth: clear session cookie under both host-only and parent-domain scope

2026-07-17 18:57:01 -07:00

auth.go

auth: clear session cookie under both host-only and parent-domain scope

2026-07-17 18:57:01 -07:00

away_test.go

adventure: show the party, the pets, and what you missed

2026-07-24 20:26:19 -07:00

away.go

adventure: show the party, the pets, and what you missed

2026-07-24 20:26:19 -07:00

csrf_test.go

web: refuse writes that come from somebody else's page

2026-09-22 22:54:38 -07:00

css_purge_test.go

web: make a purged CSS class fail the build instead of the page

2026-07-24 20:35:55 -07:00

devcasino_test.go

games: the felt that knows which seat is yours, and the rail you can talk on

2026-07-14 16:49:27 -07:00

equip_test.go

adventure: ask 7 — full equipment management from the web

2026-07-17 20:34:24 -07:00

equip.go

adventure: fix owner gear regression and drop em-dashes from equip copy

2026-07-17 20:48:02 -07:00

feed_test.go

Adventure section: ingest, permalink, digest, emblems, noindex

2026-07-11 00:53:59 -07:00

feed.go

Fix push-digest sentinel filter, watermark, and cleanups from review

2026-07-07 01:25:23 -07:00

games_clock_test.go

games: the poker table others can walk up to, and the one that empties when they leave

2026-07-14 16:37:49 -07:00

games_clock.go

games: the poker table others can walk up to, and the one that empties when they leave

2026-07-14 16:37:49 -07:00

games_hangman_test.go

games: a gallows you can bet on

2026-07-14 01:19:05 -07:00

games_hangman.go

games: the clock beats the walk button, and the rack isn't betting

2026-07-14 06:28:38 -07:00

games_holdem_multiplayer_test.go

games: the buy-in and the rake each player sees are their own, not the table's

2026-07-14 17:17:25 -07:00

games_holdem_redact_test.go

games: the poker engine learns there can be more than one of you

2026-07-14 16:05:19 -07:00

games_holdem_table.go

games: the poker table others can walk up to, and the one that empties when they leave

2026-07-14 16:37:49 -07:00

games_holdem_test.go

games: the poker table opens, and the bots go back to school

2026-07-14 09:08:59 -07:00

games_holdem.go

games: the buy-in and the rake each player sees are their own, not the table's

2026-07-14 17:17:25 -07:00

games_hub_test.go

games: the felt other people can sit at, and the version that settles the race

2026-07-14 15:43:39 -07:00

games_hub.go

games: the felt other people can sit at, and the version that settles the race

2026-07-14 15:43:39 -07:00

games_lock.go

games: the felt other people can sit at, and the version that settles the race

2026-07-14 15:43:39 -07:00

games_og_test.go

games: the door you can see from outside, and the picture on it

2026-07-14 13:30:52 -07:00

games_og.go

games: the card the dealer never turned over, and the bet that came back doubled

2026-07-14 14:22:26 -07:00

games_pages.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games_play_test.go

games: the natural the deal test didn't expect

2026-09-22 22:54:31 -07:00

games_play.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games_render_test.go

games: the poker table opens, and the bots go back to school

2026-07-14 09:08:59 -07:00

games_runtime.go

games: the poker table others can walk up to, and the one that empties when they leave

2026-07-14 16:37:49 -07:00

games_solitaire.go

solitaire: detect a won board and finish it in one press

2026-07-15 18:50:43 -07:00

games_table.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games_test.go

games: the wire the euros cross

2026-07-13 23:00:19 -07:00

games_trivia.go

games: a ladder you climb against the clock

2026-07-14 02:11:09 -07:00

games_uno_table.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games_uno_test.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games_uno.go

games: UNO becomes a table you sit at, and the pot that pays whoever goes out first

2026-07-14 18:37:51 -07:00

games.go

games: the wire the euros cross

2026-07-13 23:00:19 -07:00

handlers.go

adventure: show the party, the pets, and what you missed

2026-07-24 20:26:19 -07:00

metrics.go

Add server-side web usage metrics with !petestats command

2026-06-22 01:54:34 -07:00

mischief_test.go

mischief: a storefront where money buys a stranger some trouble

2026-07-14 20:55:15 -07:00

mischief.go

adventure: a click-through page for every adventurer on the board

2026-07-14 22:22:52 -07:00

orders_test.go

adventure: work the five review findings the last pass left open

2026-07-24 22:45:26 -07:00

orders_undo_test.go

adventure: work the five review findings the last pass left open

2026-07-24 22:45:26 -07:00

orders.go

adventure: work the five review findings the last pass left open

2026-07-24 22:45:26 -07:00

prefs_api.go

Add optional Authentik (OIDC) sign-in with server-side preference sync

2026-06-21 15:44:53 -07:00

push_adventure_test.go

adventure: tell a player what happened while they were away

2026-07-24 18:22:34 -07:00

push_adventure.go

adventure: don't strand an order on a database blip, don't misroute a tap

2026-07-24 22:36:35 -07:00

push_sender_test.go

Add personalization, outbound feeds, and PWA/push to the web UI

2026-07-07 00:07:19 -07:00

push_sender.go

adventure: tell a player what happened while they were away

2026-07-24 18:22:34 -07:00

pwa.go

adventure: let a player back out from the web, not only in Matrix

2026-07-24 21:42:59 -07:00

reader_test.go

Adventure section: ingest, permalink, digest, emblems, noindex

2026-07-11 00:53:59 -07:00

realm_test.go

adventure: give the realm a map, a board and a history

2026-07-24 17:54:49 -07:00

realm.go

adventure: give the realm a map, a board and a history

2026-07-24 17:54:49 -07:00

roster_test.go

games: a gallows you can bet on

2026-07-14 01:19:05 -07:00

roster.go

adventure: a click-through page for every adventurer on the board

2026-07-14 22:22:52 -07:00

run_report_test.go

adventure: give a finished run a report worth sharing

2026-07-24 17:11:04 -07:00

run_report.go

adventure: give a finished run a report worth sharing

2026-07-24 17:11:04 -07:00

run_test.go

adventure: tell the story of a run, not just how it ended

2026-07-24 16:33:48 -07:00

run.go

adventure: give a finished run a report worth sharing

2026-07-24 17:11:04 -07:00

season.go

Canvas-based seasonal weather effects + demo page

2026-05-25 09:20:35 -07:00

server.go

web: refuse writes that come from somebody else's page

2026-09-22 22:54:38 -07:00

siege_test.go

adventure: work the five review findings the last pass left open

2026-07-24 22:45:26 -07:00

siege.go

adventure: let a player act from the web, not just read about it

2026-07-24 18:55:42 -07:00

status_render_test.go

Adventure section: ingest, permalink, digest, emblems, noindex

2026-07-11 00:53:59 -07:00

status.go

adventure: stop dropping dispatches Pete has no words for

2026-07-24 14:46:02 -07:00

thumbs.go

Adventure news: fix posting gates, digest counts, and section gating

2026-07-11 08:07:40 -07:00

trending_test.go

Adventure section: ingest, permalink, digest, emblems, noindex

2026-07-11 00:53:59 -07:00

trivia_bank.go

games: a ladder you climb against the clock

2026-07-14 02:11:09 -07:00

tts.go

games: a gallows you can bet on

2026-07-14 01:19:05 -07:00

userstate_api.go

Add personalization, outbound feeds, and PWA/push to the web UI

2026-07-07 00:07:19 -07:00

who_map_test.go

adventure: draw the dungeon as a fog-of-war map, not a room tally

2026-07-17 08:18:17 -07:00

who_map.go

adventure: fix three review findings on the who page

2026-07-17 10:31:15 -07:00

who_party_test.go

adventure: show the party, the pets, and what you missed

2026-07-24 20:26:19 -07:00

who_test.go

adventure: show whether a backpack item is an upgrade over what's worn

2026-07-17 10:04:38 -07:00

who.go

adventure: work the five review findings the last pass left open

2026-07-24 22:45:26 -07:00

zz_drive_test.go

games: the casino moves out, and gets a clock of its own

2026-07-13 23:40:33 -07:00