fix(brokers): resolve relative API fetches against location.origin so they can't inherit credentials from a user:pass@ document URL (fetch() rejects credentialed URLs)

955b3713d8868765eddeba2e5b77a08edd4ba502 · 2026-08-06 15:26:41 -0700 · Steve

Files touched

M public/brokers.html

Diff

commit 955b3713d8868765eddeba2e5b77a08edd4ba502
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Aug 6 15:26:41 2026 -0700

    fix(brokers): resolve relative API fetches against location.origin so they can't inherit credentials from a user:pass@ document URL (fetch() rejects credentialed URLs)
---
 public/brokers.html | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/public/brokers.html b/public/brokers.html
index c081256..dcc11d4 100644
--- a/public/brokers.html
+++ b/public/brokers.html
@@ -335,6 +335,17 @@ function hasHistoryEdges(g){
   return g && g.edges && g.edges.some(e=>e.kind==='colist'||e.kind==='worked_at');
 }
 
+// If this page was opened via a credentialed URL (http://user:pass@host/…), the browser
+// keeps those credentials on document.baseURI, and a relative fetch('/api/…') inherits them —
+// which fetch() hard-rejects ("URL that includes credentials"). Resolve every relative API
+// path against location.origin (scheme://host:port, never userinfo) so no fetch can inherit
+// them. Basic-auth still flows: the browser sends its cached Authorization header same-origin.
+(function(){
+  const origin = location.origin, _fetch = window.fetch.bind(window);
+  window.fetch = (input, init) =>
+    _fetch(typeof input === 'string' && input.startsWith('/') ? origin + input : input, init);
+})();
+
 function loadGraph(){
   const historyUrl = '/api/graph?limit=500&history=1';
   const baseUrl    = '/api/graph?limit=500';

← 619dd53 Add shared two-hamburger corner navigation to every CRCP pag · back to Commercialrealestate · CRCP: add LA City Measure ULA feed — current 2025/2026 LA CR 4588a78 →