fix(login): resolve /api/login against location.origin so Basic-Auth creds-in-URL access can't taint the fetch base

d71f0c89942eabb41fd509e31a92da50cbdf383e · 2026-08-07 15:26:48 -0700 · Steve Abrams

Page reached via https://user:pass@host/login inherits creds into the document
base URL; relative fetch('/api/login') then resolves to a credentialed URL and
the Fetch spec throws 'Request cannot be constructed from a URL that includes
credentials'. location.origin never carries userinfo. Matches the surgical
single-file hotfix already deployed to prod (/root/public-projects/rentv).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M public/login.html

Diff

commit d71f0c89942eabb41fd509e31a92da50cbdf383e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Aug 7 15:26:48 2026 -0700

    fix(login): resolve /api/login against location.origin so Basic-Auth creds-in-URL access can't taint the fetch base
    
    Page reached via https://user:pass@host/login inherits creds into the document
    base URL; relative fetch('/api/login') then resolves to a credentialed URL and
    the Fetch spec throws 'Request cannot be constructed from a URL that includes
    credentials'. location.origin never carries userinfo. Matches the surgical
    single-file hotfix already deployed to prod (/root/public-projects/rentv).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/login.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/login.html b/public/login.html
index 759cbadb..fc2955c4 100644
--- a/public/login.html
+++ b/public/login.html
@@ -53,7 +53,7 @@ $('#f').addEventListener('submit', async (e)=>{
   const btn=$('#btn'), msg=$('#msg'); msg.className='msg'; msg.textContent='';
   btn.disabled=true; btn.textContent='Signing in…';
   try{
-    const r=await fetch('/api/login',{method:'POST',headers:{'Content-Type':'application/json'},
+    const r=await fetch(location.origin+'/api/login',{method:'POST',headers:{'Content-Type':'application/json'},
       body:JSON.stringify({username:$('#u').value,password:$('#p').value})});
     const j=await r.json();
     if(!r.ok||!j.ok) throw new Error(j.error||('HTTP '+r.status));

← ee2f9802 fix: inject template-toggle.js (View-all compare) site-wide · back to Rentv 2026 · chore: v0.24.0 (session close — View-all toggle wired + prev 4295511a →