deer-flow

mirror of https://github.com/bytedance/deer-flow.git synced 2026-10-27 13:40:37 +00:00

History

fix(api): survive a malformed CSRF cookie (#7589 )

* fix(api): survive a malformed CSRF cookie

`readCsrfCookie` percent-decodes a cookie the gateway sets verbatim.
Cookies are shared by every app on the same host (ports included), so a
stray or truncated `%` escape from another local app, a proxy, or a stale
value makes `decodeURIComponent` throw `URIError` inside `fetch` and
`getCsrfHeaders` — every state-changing call fails with an exception
before the gateway can answer 403.

Fall back to the raw cookie value when decoding fails, matching
`getLocaleFromCookie` (#7553).

* test(api): exercise sibling CSRF cookies in the DOM

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-10-27 09:47:24 +08:00

app

fix(frontend): return SSO sign-ins to their next path (#7467 )

2026-10-26 19:24:35 +08:00

components

fix(channels): keep IM binding codes on screen and report goal state in replies (#7591 )

2026-10-27 09:46:58 +08:00

content

docs(checkpoints): add a ten-chapter checkpoint storage manual in both languages (#5845 )

2026-09-25 10:23:36 +08:00

core

fix(api): survive a malformed CSRF cookie (#7589 )