← back to Costa Rica
add creds-in-URL fetch guard to gated pages (TK-10984)
a9a77cbd10839e46ada2f5b751350ad48763cfb9 · 2026-08-30 22:58:29 -0700 · Steve Abrams
Files touched
M public/about.htmlM public/build.htmlM public/index.htmlM public/map.htmlM public/place.htmlM public/province.htmlM public/provinces.htmlM public/region.htmlM public/search.htmlM public/stats.htmlM public/vertical.htmlM public/verticals.html
Diff
commit a9a77cbd10839e46ada2f5b751350ad48763cfb9
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Sun Aug 30 22:58:29 2026 -0700
add creds-in-URL fetch guard to gated pages (TK-10984)
---
public/about.html | 24 ++++++++++++++++++++++++
public/build.html | 24 ++++++++++++++++++++++++
public/index.html | 24 ++++++++++++++++++++++++
public/map.html | 24 ++++++++++++++++++++++++
public/place.html | 24 ++++++++++++++++++++++++
public/province.html | 24 ++++++++++++++++++++++++
public/provinces.html | 24 ++++++++++++++++++++++++
public/region.html | 24 ++++++++++++++++++++++++
public/search.html | 24 ++++++++++++++++++++++++
public/stats.html | 24 ++++++++++++++++++++++++
public/vertical.html | 24 ++++++++++++++++++++++++
public/verticals.html | 24 ++++++++++++++++++++++++
12 files changed, 288 insertions(+)
diff --git a/public/about.html b/public/about.html
index b38b8b8..24f274b 100644
--- a/public/about.html
+++ b/public/about.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>About — Costa Rica Directory</title>
diff --git a/public/build.html b/public/build.html
index a90fb01..af6758d 100644
--- a/public/build.html
+++ b/public/build.html
@@ -1,5 +1,29 @@
<!doctype html>
<html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
<title>CR Marketplace — Build Ops</title>
<style>
diff --git a/public/index.html b/public/index.html
index e32ea76..5c8de71 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Costa Rica Directory — tourism · rentals · local services</title>
diff --git a/public/map.html b/public/map.html
index 7380e74..59ef1a4 100644
--- a/public/map.html
+++ b/public/map.html
@@ -1,5 +1,29 @@
<!doctype html>
<html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
<title>Costa Rica — Places Map</title>
<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"/>
diff --git a/public/place.html b/public/place.html
index 0647728..03a743e 100644
--- a/public/place.html
+++ b/public/place.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Loading… — Costa Rica Directory</title>
diff --git a/public/province.html b/public/province.html
index 6d16fc7..f4e4df6 100644
--- a/public/province.html
+++ b/public/province.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Loading… — Costa Rica Directory</title>
diff --git a/public/provinces.html b/public/provinces.html
index 39d9028..229b767 100644
--- a/public/provinces.html
+++ b/public/provinces.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>The 7 Provinces — Costa Rica Directory</title>
diff --git a/public/region.html b/public/region.html
index 62e9fe3..c56e261 100644
--- a/public/region.html
+++ b/public/region.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Loading… — Costa Rica Directory</title>
diff --git a/public/search.html b/public/search.html
index f8a10da..5af5e6f 100644
--- a/public/search.html
+++ b/public/search.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Search — Costa Rica Directory</title>
diff --git a/public/stats.html b/public/stats.html
index a110892..16b388e 100644
--- a/public/stats.html
+++ b/public/stats.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Stats — Costa Rica Directory</title>
diff --git a/public/vertical.html b/public/vertical.html
index 55629ac..60f4cf7 100644
--- a/public/vertical.html
+++ b/public/vertical.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Loading… — Costa Rica Directory</title>
diff --git a/public/verticals.html b/public/verticals.html
index e551045..5948051 100644
--- a/public/verticals.html
+++ b/public/verticals.html
@@ -1,6 +1,30 @@
<!doctype html>
<html lang="en" data-theme="light">
<head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+ var _fetch = window.fetch.bind(window);
+ var cleanBase = function () { return location.origin + location.pathname; };
+ window.fetch = function (input, init) {
+ try {
+ if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+ input = new URL(input, cleanBase()).href;
+ } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+ input = new Request(new URL(input.url, cleanBase()).href, input);
+ }
+ } catch (_) { /* fall through to native */ }
+ return _fetch(input, init);
+ };
+})();
+</script>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Verticals — Costa Rica Directory</title>
← 471a896 Add public /privacy + /support pages before basic-auth gate
·
back to Costa Rica
·
Costa Rica server: remove the contacts import / list / invit 89fa33c →