Add --port

internal/server/server.go

@@ -62,6 +62,7 @@ func (s *Server) routes() http.Handler {
 	mux.HandleFunc("GET /d/{id}", s.handleDownload)
 	mux.HandleFunc("GET /i/{id}", s.handleInfo)
 	mux.HandleFunc("POST /api/d/{id}/delete", s.handleDelete)
+	mux.HandleFunc("POST /api/forget", s.handleForget)
 	mux.Handle("GET /static/", http.StripPrefix("/static/", s.staticHandler()))
 	mux.HandleFunc("/", s.handleNotFound)
 
@@ -94,8 +95,14 @@ func (s *Server) staticHandler() http.Handler {
 
 // appCSP locks the application pages down to their own origin. The frontend has
 // no inline script and no third-party anything, so this can be strict.
+//
+// connect-src is not optional here: the upload page talks to /api/upload and
+// /api/limits over XMLHttpRequest, and every fetch-directive left unlisted
+// falls back to default-src, so omitting it makes the browser block every
+// upload before it reaches the network. See TestAppCSPAllowsWhatThePageDoes.
 const appCSP = "default-src 'none'; script-src 'self'; style-src 'self'; " +
-	"img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+	"img-src 'self' data:; connect-src 'self'; form-action 'self'; " +
+	"base-uri 'none'; frame-ancestors 'none'"
 
 func (s *Server) securityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {