mirror of
https://github.com/farion1231/cc-switch.git
synced 2026-07-24 12:44:18 +08:00
Jason
c01338ac33
SSRF protection (private IP blocking, suspicious hostname detection) was originally added for web-server threat models but is unnecessary for a local desktop app where the user already has full network access. This removal unblocks legitimate use cases like enterprise intranet APIs, Docker container addresses, and self-hosted services. Retained: HTTPS enforcement and same-origin checks which still provide meaningful security (protecting API keys in transit and preventing scripts from leaking keys to unrelated domains).