- require an Origin equal to the request's own scheme://host:port and,
when sent, Sec-Fetch-Site: same-origin; refuse every forwarding-style
header (Via, X-Forwarded-*, X-Original-*, *-Client-IP, CF-Connecting-IP
and the rest) as remote (security review M1, L2)
- answer a non-JSON body with 415, so a cross-origin request always needs
a CORS preflight (L2)
- single flight plus a 1 s cooldown per process: 429 code busy (L1)
- path resolution errors such as ENAMETOOLONG are a JSON 404, and neither
that nor a start failure logs the client's path at error level (L3)
Vito Sansevero
6c4c587d9e