Sameh Khamis b75db874c6 Read API paths and forwarded requests as the router does ...

The router reads an absolute-form target's path without resolving dot
segments, so a target such as http://host/api/../x still reaches /api
middleware. Take that path the same way when deciding whether the API
response headers apply.

The Street View fallback now treats any forwarding header as forwarded, even
an empty one, before it spends the key.

2026-10-21 15:43:29 -07:00

..

allowedHosts.js

fix(server): apply the Host check before the app's own routes

2026-10-02 20:15:54 -07:00

application-html.js

refactor(app): share application components and request services

2026-09-13 22:41:11 -07:00

embed-framing.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

panel.js

Run the worker prelude ahead of Cesium's own workers script

2026-10-02 18:29:42 -07:00

vite.js

Read API paths and forwarded requests as the router does

2026-10-21 15:43:29 -07:00