office: fetch API via location.origin so embedded-credential page URLs don't break polling

ca852247b474676f08e09a1cb460bf43491dfe20 · 2026-07-27 07:37:56 -0700 · Steve Abrams

Fetch spec forbids constructing a Request from a URL containing credentials; a
page opened as http://user:pass@host/office resolved relative /api paths against
that base and threw. Resolve against location.origin (no userinfo) instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M office.html

Diff

commit ca852247b474676f08e09a1cb460bf43491dfe20
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 27 07:37:56 2026 -0700

    office: fetch API via location.origin so embedded-credential page URLs don't break polling
    
    Fetch spec forbids constructing a Request from a URL containing credentials; a
    page opened as http://user:pass@host/office resolved relative /api paths against
    that base and threw. Resolve against location.origin (no userinfo) instead.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 office.html | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/office.html b/office.html
index 6a7aa83..f8d762a 100644
--- a/office.html
+++ b/office.html
@@ -365,9 +365,13 @@ function placeAvatars(tickets){
 // ───────────────────────── live data ─────────────────────────
 async function poll(){
   try{
+    // Build from location.origin (never contains userinfo) so an embedded-credential
+    // page URL — e.g. opened as http://user:pass@host/office — can't poison the
+    // fetch URL. The Fetch spec rejects any Request built from a URL with credentials.
+    const api = p => new URL(p, location.origin).href;
     const [tr, mr] = await Promise.all([
-      fetch('/api/tickets', {credentials:'same-origin'}),
-      fetch('/api/messages',{credentials:'same-origin'}),
+      fetch(api('/api/tickets'), {credentials:'same-origin'}),
+      fetch(api('/api/messages'),{credentials:'same-origin'}),
     ]);
     if(!tr.ok||!mr.ok) throw new Error('HTTP '+tr.status+'/'+mr.status);
     const tickets = await tr.json();

← 3dd588f office: add 'Ping ✦' DM-animation preview button + recording · back to Ticket System · auto-save: 2026-07-27T07:48:56 (1 files) — office.html c4b15ed →