add creds-in-URL fetch guard to gated pages (TK-10984)

588c4d864eb3cbbf706b95d34e67850fad1f0268 · 2026-08-30 22:57:40 -0700 · Steve Abrams
Files touched

M public/account.html
M public/admin.html
M public/broker-profile.html
M public/broker.html
M public/claims.html
Diff

commit 588c4d864eb3cbbf706b95d34e67850fad1f0268
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Aug 30 22:57:40 2026 -0700

    add creds-in-URL fetch guard to gated pages (TK-10984)
---
 public/account.html        | 24 ++++++++++++++++++++++++
 public/admin.html          | 24 ++++++++++++++++++++++++
 public/broker-profile.html | 24 ++++++++++++++++++++++++
 public/broker.html         | 24 ++++++++++++++++++++++++
 public/claims.html         | 24 ++++++++++++++++++++++++
 5 files changed, 120 insertions(+)

diff --git a/public/account.html b/public/account.html
index 87f05cc..725c58f 100644
--- a/public/account.html
+++ b/public/account.html
@@ -1,5 +1,29 @@
 <!doctype html>
 <html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Account · Sublease Marketplace</title>
 <style>
diff --git a/public/admin.html b/public/admin.html
index 50c89f9..2f8285b 100644
--- a/public/admin.html
+++ b/public/admin.html
@@ -1,5 +1,29 @@
 <!doctype html>
 <html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Admin · CRUnifiedDB</title>
 <style>
diff --git a/public/broker-profile.html b/public/broker-profile.html
index d21c61b..557b606 100644
--- a/public/broker-profile.html
+++ b/public/broker-profile.html
@@ -1,5 +1,29 @@
 <!doctype html>
 <html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Broker · Sublease Marketplace</title>
 <style>
diff --git a/public/broker.html b/public/broker.html
index dd3b895..c6f8175 100644
--- a/public/broker.html
+++ b/public/broker.html
@@ -1,5 +1,29 @@
 <!doctype html>
 <html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Broker · Sublease Marketplace</title>
 <style>
diff --git a/public/claims.html b/public/claims.html
index 0ad02dd..b37d8af 100644
--- a/public/claims.html
+++ b/public/claims.html
@@ -1,5 +1,29 @@
 <!doctype html>
 <html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Profile claims · Admin</title>
 <style>
← c258c5d sponsors/brokers queries: SELECT * -> explicit full column l · back to Sublease Agentabrams · deploy-safety: exclude data/ from rsync (TK-10984) 7ecde77 →