fix(stats): restrict local requests and serve the dashboard over HTTP (#263)

2026-09-21 05:16:20 -07:00 · 2026-09-20 23:36:55 -07:00
parent 2f21582666
commit ab48a5678e
16 changed files with 221 additions and 157 deletions
@@ -0,0 +1,6 @@
+type: changed
+breaking: true
+area: stats
+
+- Reject requests from untrusted browser origins and hosts before stats data, media, or Anki operations run, and require JSON for mutation bodies.
+- Load the in-app stats overlay from the local server so it uses the same origin protection as the browser dashboard.