Talon/chat_grid
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Enforce websocket origin allowlist with secure-mode config"

Browse Source 
This reverts commit cf30229b37.
This commit is contained in:
Jage9
2026-02-28 04:52:44 -05:00
parent cf30229b37
commit 027f04e58d
9 changed files with 1 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/protocol-notes.md
View File

@@ -111,7 +111,6 @@ This is a behavior guide for packet semantics beyond raw schemas.
- Server is authoritative for all action validation and normalization.
- Server is authoritative for movement acceptance (bounds + rate/delta checks).
- Server enforces websocket Origin allowlist at handshake (`network.allowed_origins`).
- Server persists account state (last nickname + last position) and restores spawn from that state on auth login/resume.
- Server also supports websocket handshake cookie resume:
- reads `chgrid_session_token` from websocket `Cookie` header