Referrer-Policy same-origin: Firefox sent Origin: null under no-referrer and sign-in was refused as cross-origin

Co-Authored-By: Claude Fable 5.1 <[email protected]>
2026-10-17 12:32:44 -06:00
parent b638f0c2f2
commit e9dd3f205b
3 changed files with 7 additions and 2 deletions
@@ -27,7 +27,8 @@ HEADERS: dict[str, str] = {
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY",
-    "Referrer-Policy": "no-referrer",
+    # Not no-referrer: under it Firefox sends Origin: null on same-origin POSTs and the Origin check refuses them.
+    "Referrer-Policy": "same-origin",
    "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
    "Cross-Origin-Opener-Policy": "same-origin",
    "Content-Security-Policy": CSP,