kolaente 9fbce2154b fix(license): refuse redirects and use the SSRF-safe http client for checks ...

The license servers are hardcoded, but the check client followed redirects
without any policy and dialed without the SSRF guard, so a hijacked or
poisoned license host could forward the license key to an internal address.
Redirects are refused outright rather than capped: the check is a POST to a
fixed JSON API that never redirects.

2026-07-28 17:26:12 +02:00

..

check_test.go

fix(license): refuse redirects and use the SSRF-safe http client for checks

2026-07-28 17:26:12 +02:00

check.go

fix(license): refuse redirects and use the SSRF-safe http client for checks

2026-07-28 17:26:12 +02:00

license.go

fix(license): degrade to free when servers unreachable or key rejected

2026-04-20 18:55:06 +00:00