TK-12268: add creds-in-URL fetch guard (fleet pattern) to gated page

7ae3e7345b2310db2a9ab043dd86146d248f7fea · 2026-09-25 13:56:00 -0700 · Steve Abrams

Relative fetch() on a Basic-Auth page threw on user:pass@host bookmarks.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D7LB6rCwpA7ubJTqYzqXEX

Files touched

M public/index.html

Diff

commit 7ae3e7345b2310db2a9ab043dd86146d248f7fea
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 25 13:56:00 2026 -0700

    TK-12268: add creds-in-URL fetch guard (fleet pattern) to gated page
    
    Relative fetch() on a Basic-Auth page threw on user:pass@host bookmarks.
    
    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01D7LB6rCwpA7ubJTqYzqXEX
---
 public/index.html | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index bf0f4db..e7711bb 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1,4 +1,29 @@
-<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<!doctype html><html><head><meta charset="utf-8">
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
+<meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Flock Fix — Live</title><style>
 :root{--bg:#0e0f13;--card:#171922;--line:#252838;--txt:#e7e9f0;--mut:#8b90a6;--ok:#25c26e;--bad:#ff5c6c;--warn:#f2b134;--accent:#7c8cff}
 *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--txt);font:14px/1.4 -apple-system,BlinkMacSystemFont,Segoe UI,sans-serif}

← 09bf1a1 governance(TK-11370): make live-by-default Shopify writers d · back to Flock Fix Viewer · (newest)