← back to Consulting Designerwallcoverings Com
add creds-in-URL fetch guard to gated portal + admin pages (TK-22)
3dab9db8297254891e4c783f82ee94069da808b6 · 2026-08-30 09:24:15 -0700 · Steve Abrams
Files touched
M build.mjsM public/admin/index.htmlM public/portal.html
Diff
commit 3dab9db8297254891e4c783f82ee94069da808b6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Sun Aug 30 09:24:15 2026 -0700
add creds-in-URL fetch guard to gated portal + admin pages (TK-22)
---
build.mjs | 24 ++++++++++++++++++++++++
public/admin/index.html | 24 ++++++++++++++++++++++++
public/portal.html | 24 ++++++++++++++++++++++++
3 files changed, 72 insertions(+)
diff --git a/build.mjs b/build.mjs
index 9a0e4ff..53b756c 100644
--- a/build.mjs
+++ b/build.mjs
@@ -253,6 +253,30 @@ const connectedCount = (SNAP.channels || []).filter(c => c.connected).length;
/* =========================================================== the portal app === */
const app = `<!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\\/\\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\\/\\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>Designer Wallcoverings — Growth Strategy</title>
<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
diff --git a/public/admin/index.html b/public/admin/index.html
index de3e437..04200bb 100644
--- a/public/admin/index.html
+++ b/public/admin/index.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
<title>Designer Wallcoverings · Growth & Social Command Center</title>
<style>
diff --git a/public/portal.html b/public/portal.html
index 5a95a9d..c6bd3fd 100644
--- a/public/portal.html
+++ b/public/portal.html
@@ -1,4 +1,28 @@
<!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>Designer Wallcoverings — Growth Strategy</title>
<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
← 613a8e5 add rel=noopener noreferrer to the 6 version-concept target=
·
back to Consulting Designerwallcoverings Com
·
fix Newest concept sort restoring natural order 133ec42 →