celeb: allow /.well-known/ through the sensitive-path guard (Apple domain-association file for Sign in with Apple) — dotfiles otherwise still blocked

7f435c2da3163fd6b53525c81e78d6075dc392fb · 2026-08-07 10:09:11 -0700 · Steve

Files touched

M server.js

Diff

commit 7f435c2da3163fd6b53525c81e78d6075dc392fb
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Aug 7 10:09:11 2026 -0700

    celeb: allow /.well-known/ through the sensitive-path guard (Apple domain-association file for Sign in with Apple) — dotfiles otherwise still blocked
---
 server.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 7f0082a..dc0b992 100644
--- a/server.js
+++ b/server.js
@@ -290,7 +290,11 @@ createServer(async (req, res) => {
     // ===== sensitive-path guard =====
     // data/ (accounts, sessions, ledgers, private uploads) and scripts/ are
     // NEVER directly fetchable; public JSON flows only through /api/* routes.
-    if (/^\/(data|scripts|tmp_|\.)/.test(path) || path.includes('..')) {
+    // Block data/, scripts/, tmp_*, and dotfiles — EXCEPT /.well-known/ (Apple's
+    // Sign in with Apple domain-association file is served from there).
+    if (/^\/(data|scripts|tmp_)/.test(path)
+        || (path.startsWith('/.') && !path.startsWith('/.well-known/'))
+        || path.includes('..')) {
       res.writeHead(403, { 'Content-Type': 'text/plain' }).end('forbidden'); return;
     }

← 5c6df61 celeb mobile: add Sign in with Apple button to AccountScreen · back to CelebritySignatures · celeb web: add Sign in with Apple button to the account.js l cb846f4 →