saopig1andClaude Opus 4.8 f720da49d6 fix(web): referrer-policy same-origin so same-origin POSTs keep a real Origin ...

no-referrer downgraded the Origin header to the literal "null" on same-origin non-GET requests (per the WHATWG Fetch "Append a request Origin header" algorithm), which the /api/* csrfOriginCheck then rejected with 403 "bad origin" — silently breaking QR login, cookie save, and every other WebUI POST/PUT/DELETE/PATCH (playback, bot management, user admin). /api/session/* was unaffected because it mounts before the CSRF gate, which is why WebUI login still worked.

same-origin keeps the real Origin on same-origin requests (CSRF passes) while still sending no Referer cross-origin, so B站/NetEase/QQ CDN cover thumbnails keep loading. Adds referrer-policy.test.ts pinning the policy and a csrf.test.ts case for the Origin: "null" rejection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-29 21:25:20 +08:00

..

src

fix(web): revert textarea + actual culprit was B站热门 card grid

2026-05-27 17:20:46 +08:00

index.html

fix(web): referrer-policy same-origin so same-origin POSTs keep a real Origin

2026-05-29 21:25:20 +08:00

package-lock.json

fix #37

2026-04-20 23:48:46 +08:00

package.json

feat: add QR code login for NetEase/QQ Music accounts in Settings page

2026-03-30 01:34:06 +08:00

tsconfig.json

feat: add Vue.js WebUI — YesPlayMusic-inspired SPA with all pages and components

2026-03-30 00:58:33 +08:00

tsconfig.node.json

feat: add Vue.js WebUI — YesPlayMusic-inspired SPA with all pages and components

2026-03-30 00:58:33 +08:00

vite.config.ts

feat: add Vue.js WebUI — YesPlayMusic-inspired SPA with all pages and components

2026-03-30 00:58:33 +08:00