mitchell/hamlab
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 14 Wiki Activity

Sensor API answers other origins (token only); external demo page

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Mitchell-Johnson
2026-09-19 08:49:59 -07:00
co-authored by Claude Fable 5.1
parent 0b0b2897cb
commit 65a9888784
4 changed files with 229 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SENSORS.md
+7
View File
@@ -202,3 +202,10 @@ closed while the page is hidden, refilled when it returns. `web/src/sampleAdapte
the seam that hands the stock modules the object they were written against. The old
`/api/metrics` and `/api/metrics/history` are gone. `hamlab.sample_interval` is the
sampler's own rate, as a sensor.
## From another origin
The sensor endpoints (and only they) answer any origin: `Access-Control-Allow-Origin: *`,
preflight included. `*` is the one value browsers won't combine with cookies, so a foreign
page can reach the API with a token and can never ride a logged-in console's session.
`examples/external-demo/` is a complete outside consumer in one HTML file.