2 Commits

Author	SHA1	Message	Date
一片一片	52f6ff078c	fix(api): survive a malformed CSRF cookie (#7589) ... * fix(api): survive a malformed CSRF cookie `readCsrfCookie` percent-decodes a cookie the gateway sets verbatim. Cookies are shared by every app on the same host (ports included), so a stray or truncated `%` escape from another local app, a proxy, or a stale value makes `decodeURIComponent` throw `URIError` inside `fetch` and `getCsrfHeaders` — every state-changing call fails with an exception before the gateway can answer 403. Fall back to the raw cookie value when decoding fails, matching `getLocaleFromCookie` (#7553). * test(api): exercise sibling CSRF cookies in the DOM --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>	2026-10-27 09:47:24 +08:00
Cordis798	17f2bea275	fix(api): preserve Request inputs in authenticated fetch (#7254) ... * fix(api): preserve Request inputs in authenticated fetch * docs(frontend): keep fetch guidance within the size budget * test(api): address fetcher review feedback --------- Co-authored-by: Cordis798 <284918518+Cordis798@users.noreply.github.com> Co-authored-by: Willem Jiang <willem.jiang@gmail.com>	2026-10-22 16:05:43 +08:00