fix: preserve browser form origins for update panel authentication

2026-10-24 14:49:43 +08:00
parent 2f11a8c904
commit 9a198fe466
4 changed files with 76 additions and 1 deletions
@@ -229,7 +229,10 @@ class RequestBounds:
            if message['type'] == 'http.response.start':
                message['headers'] += [
                    (b'cache-control', b'no-store'), (b'x-content-type-options', b'nosniff'),
-                    (b'referrer-policy', b'no-referrer'), (b'x-frame-options', b'DENY'),
+                    # no-referrer makes native form POSTs send Origin: null.
+                    # Keep same-origin form authentication working without
+                    # disclosing referrers to other sites.
+                    (b'referrer-policy', b'same-origin'), (b'x-frame-options', b'DENY'),
                    (b'content-security-policy', b"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"),
                ]
            await send(message)