Sameh Khamis 72e1469968 Apply consistent API response headers ...

Every /api response, including errors, partial responses, Host refusals and
unknown routes, now carries a sandboxing Content-Security-Policy and
X-Content-Type-Options: nosniff on the dev and preview servers. Vite's server
and preview headers only reach the documents and assets it serves itself, so
a small plugin sets them ahead of the Host check. A route's own policy is sent
as an additional policy rather than replacing it.

2026-10-21 15:07:00 -07:00

..

allowedHosts.js

fix(server): apply the Host check before the app's own routes

2026-10-02 20:15:54 -07:00

application-html.js

refactor(app): share application components and request services

2026-09-13 22:41:11 -07:00

embed-framing.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

panel.js

Run the worker prelude ahead of Cesium's own workers script

2026-10-02 18:29:42 -07:00

vite.js

Apply consistent API response headers

2026-10-21 15:07:00 -07:00