Add rel=noopener noreferrer + serve /docs static for api-playground links

1f77b3dd6ee8417a6e82a5c733cfde14f8058884 · 2026-05-19 21:39:32 -0700 · Steve Abrams

api-playground.html had three target=_blank quick-links without rel
attrs (window.opener exploit risk pre-2021 browsers). Added rel on all
three. The "Full Guide" link points at /docs/API_COMPLETE_GUIDE.md but
no static handler served /docs — added express.static for ./docs with
text/markdown content-type so the link no longer dead-404s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/api-playground.html
M server.js

Diff

commit 1f77b3dd6ee8417a6e82a5c733cfde14f8058884
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:39:32 2026 -0700

    Add rel=noopener noreferrer + serve /docs static for api-playground links
    
    api-playground.html had three target=_blank quick-links without rel
    attrs (window.opener exploit risk pre-2021 browsers). Added rel on all
    three. The "Full Guide" link points at /docs/API_COMPLETE_GUIDE.md but
    no static handler served /docs — added express.static for ./docs with
    text/markdown content-type so the link no longer dead-404s.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/api-playground.html | 6 +++---
 server.js                  | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/public/api-playground.html b/public/api-playground.html
index 62996f1..0dfa006 100755
--- a/public/api-playground.html
+++ b/public/api-playground.html
@@ -335,9 +335,9 @@
             <h1>Omega Watch API Playground</h1>
             <p>Interactive API testing and exploration</p>
             <div class="quick-links">
-                <a href="/api/docs/swagger" class="quick-link" target="_blank">Swagger UI</a>
-                <a href="/api/docs/openapi.json" class="quick-link" target="_blank">OpenAPI Spec</a>
-                <a href="/docs/API_COMPLETE_GUIDE.md" class="quick-link" target="_blank">Full Guide</a>
+                <a href="/api/docs/swagger" class="quick-link" target="_blank" rel="noopener noreferrer">Swagger UI</a>
+                <a href="/api/docs/openapi.json" class="quick-link" target="_blank" rel="noopener noreferrer">OpenAPI Spec</a>
+                <a href="/docs/API_COMPLETE_GUIDE.md" class="quick-link" target="_blank" rel="noopener noreferrer">Full Guide</a>
             </div>
         </div>
 
diff --git a/server.js b/server.js
index fb11e4f..15d9ed7 100755
--- a/server.js
+++ b/server.js
@@ -140,6 +140,15 @@ app.use('/museum', express.static('museum', {
   etag: true
 }));
 
+// Markdown docs (api-playground "Full Guide" link points at /docs/*.md)
+app.use('/docs', express.static('docs', {
+  maxAge: '1h',
+  etag: true,
+  setHeaders: (res, filepath) => {
+    if (filepath.endsWith('.md')) res.setHeader('Content-Type', 'text/markdown; charset=utf-8');
+  }
+}));
+
 // Request logging middleware with performance tracking
 app.use((req, res, next) => {
   const start = Date.now();

← 6aff506 Add /api 404 guard before SPA catch-all · back to Watches · Add snapshot-file 404 guard for .bak/.pre-/.orig/.rej paths db8e98e →