CogentialandClaude Opus 5.5 6635ac1342 Require a secret for every API request, loopback included; check Host and Origin ...

The service makes up a web password and a headset-app key on first start (config.json, mode 600). The headset
app sends the key in X-Frametanium-Key and shows the page's address and password under its list; the page sends
the password in X-Key (no more ?key=). Unknown Host names (DNS rebinding) and cross-site Origins get 403, wrong
secrets wait a second. Headset apps from before this see 'close this app and open it again' after a self-update.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C3G4bF9bag9rHEh1Anvngi

2026-10-21 00:07:54 -04:00

..

third_party

Port Manager: install and update Steam Frame ports from GitHub releases

2026-10-05 13:59:43 -04:00

app.c

Require a secret for every API request, loopback included; check Host and Origin

2026-10-21 00:07:54 -04:00

build-arm64.sh

App: let SDL see Steam's virtual gamepad as an Xbox pad, so the D-pad and sticks work on the Frame

2026-10-09 16:09:15 -04:00