fix: creds-in-URL fetch guard (CRCP-class bug); pin port 9772; verified live render

c30c2a5a85e8dd99528a56365212e90efcabe17b · 2026-08-25 10:15:39 -0700 · Steve

Files touched

M public/index.html

Diff

commit c30c2a5a85e8dd99528a56365212e90efcabe17b
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 10:15:39 2026 -0700

    fix: creds-in-URL fetch guard (CRCP-class bug); pin port 9772; verified live render
---
 public/index.html | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/public/index.html b/public/index.html
index 5c6fe89..023ff6b 100644
--- a/public/index.html
+++ b/public/index.html
@@ -102,6 +102,22 @@
 <div class="foot" id="foot"></div>
 
 <script>
+// Guard against the creds-in-URL fetch bug: when the page is opened as
+// http://admin:PASS@host/ (Basic-auth in the URL), those creds persist in
+// document.baseURI, and a relative fetch() throws "Request cannot be
+// constructed from a URL that includes credentials". Resolve every relative
+// URL against location.origin (which has NO creds) before fetching.
+(function(){
+  const _f = window.fetch.bind(window);
+  window.fetch = function(input, init){
+    try{
+      if(typeof input === 'string' && !/^https?:\/\//i.test(input)){
+        input = new URL(input, location.origin).href;
+      }
+    }catch(e){}
+    return _f(input, init);
+  };
+})();
 const $ = (s)=>document.querySelector(s);
 let DATA = {jobs:[]};

← 5c67115 initial scaffold: cronjobs-viewer live launchd cron calendar · back to Cronjobs Viewer · viewer: de-slugged label fallback so every card has a purpos 3ac193b →