feat(mobile-control): client allowlist, automatic blocking of abusive addresses, and request hardening (all opt-in) - #1498

Open

anthony-lopez-pd wants to merge 11 commits into

mainfrom

feat/mc-client-allowlist

Commits on Oct 1, 2026

fix: stop mutating _userAppBaseHref in HandleUserAppRequest

anthony-lopez-pd
and
claude
committed
01c10bb
feat: allowedClientNetworks allowlist and source-address logging for the Mobile Control direct server

anthony-lopez-pd
and
claude
committed
e5c0ee6
fix: drop refused connections with Abort() instead of replying 403

anthony-lopez-pd
and
claude
committed
446dfde
fix: drop connections for unrecognised GET paths instead of replying 404

anthony-lopez-pd
and
claude
committed
b0a9ab5
feat: autoBlock for the Mobile Control direct server; make dropping unrecognised requests opt-in

anthony-lopez-pd
and
claude
committed
38667f3
fix: don't count ordinary browser requests as unwanted traffic

anthony-lopez-pd
and
claude
committed
9216f70

Commits on Oct 2, 2026

fix(mobile-control): address review feedback on client filtering

anthony-lopez-pd
and
claude
committed
058f3b3
fix(mobile-control): harden auto-block ownership and POST filtering

anthony-lopez-pd
and
claude
committed
be85155

Commits on Oct 3, 2026

fix(mobile-control): close block/expiry race and two request edge cases

anthony-lopez-pd
and
claude
committed
acfab3e
fix(mobile-control): match IPv4-mapped CIDRs and guard unreadable block state

anthony-lopez-pd
and
claude
committed
939ea5e

Commits on Oct 4, 2026

fix(mobile-control): treat any bad block-list entry as unreadable

anthony-lopez-pd
and
claude
committed
f771063