creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)

9a406b839d36a9d8f52948a00d909e68631f1ef9 · 2026-08-25 10:48:53 -0700 · Steve

Fleet inoculation — opening this basic-auth app with credentials in the URL
poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html

Diff

commit 9a406b839d36a9d8f52948a00d909e68631f1ef9
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 10:48:53 2026 -0700

    creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)
    
    Fleet inoculation — opening this basic-auth app with credentials in the URL
    poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
    non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/index.html | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/public/index.html b/public/index.html
index 7f8ec3a..b991cfd 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1,6 +1,30 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8">
 <title>agentabrams.com — Domain Viewer</title>
 <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3E%3Crect width='16' height='16' rx='3' fill='%2328412f'/%3E%3Ctext x='8' y='12' text-anchor='middle' font-family='Georgia,serif' font-size='11' fill='%23f7f1e6'%3Ea%3C/text%3E%3C/svg%3E">

← 096b817 domain viewer: add sort + list/grid toggle + density + per-f · back to Agentabrams Viewer · (newest)