e11c9ab58b
The same-origin check compared the browser's Origin header against new URL(request.url), but inside the Planner container request.url is http://planner:3001/... while the browser sends Origin https://planner.trails.cool — so production always 403'd. Trust Caddy's X-Forwarded-Host and X-Forwarded-Proto headers when present (both are set by Caddy's reverse_proxy directive by default) to reconstruct the external origin the browser actually connected to. Falls back to request.url for dev and any direct (non-proxied) access. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| journal | ||
| mobile | ||
| planner | ||