From e9dd3f205b0be422601498062baa781f60209771 Mon Sep 17 00:00:00 2001 From: Spencer McGuire Date: Sat, 17 Oct 2026 12:32:44 -0600 Subject: [PATCH] Referrer-Policy same-origin: Firefox sent Origin: null under no-referrer and sign-in was refused as cross-origin Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 4 ++++ server/packetstation/security.py | 3 ++- tests/server/test_app.py | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3719247..6176295 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project are recorded here. The format follows [Keep ## [Unreleased] +### Fixed + +- Sign-in refused as cross-origin in Firefox: the app sent `Referrer-Policy: no-referrer`, under which Firefox sends `Origin: null` on same-origin POSTs. The policy is now `same-origin`, which still sends nothing to other sites. + ### Added - Phase 5: the shop. The Supervisor screen (department chips for people who lead several departments, the change-order headline that cannot be closed, the numbers Ready to assign, At stations, Waiting on review and Station hours vs target, the Change orders on hold table, the station grid with a tile per station showing the job, the welder and stamp, the ticking clock against the target hours and a CHANGE ORDER tag, and the boards Ready to assign, Waiting on review, At Q.C., With warehouse and Routed on) and the Stall screen (station picker, the station hero, My packets and Submitted, waiting on supervisor). diff --git a/server/packetstation/security.py b/server/packetstation/security.py index 848410a..2b77867 100644 --- a/server/packetstation/security.py +++ b/server/packetstation/security.py @@ -27,7 +27,8 @@ HEADERS: dict[str, str] = { "Strict-Transport-Security": "max-age=31536000; includeSubDomains", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", - "Referrer-Policy": "no-referrer", + # Not no-referrer: under it Firefox sends Origin: null on same-origin POSTs and the Origin check refuses them. + "Referrer-Policy": "same-origin", "Permissions-Policy": "camera=(), microphone=(), geolocation=()", "Cross-Origin-Opener-Policy": "same-origin", "Content-Security-Policy": CSP, diff --git a/tests/server/test_app.py b/tests/server/test_app.py index 3faf8ae..d2f0205 100644 --- a/tests/server/test_app.py +++ b/tests/server/test_app.py @@ -19,7 +19,7 @@ EXPECTED = { "strict-transport-security": "max-age=31536000; includeSubDomains", "x-content-type-options": "nosniff", "x-frame-options": "DENY", - "referrer-policy": "no-referrer", + "referrer-policy": "same-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin", }