fix(web): send only the origin as referrer on login pages so the sign-in POST keeps its Origin

commit: 19cd78fa8a5a076f5ae76f2ad87f8347e000821a
author: brice · 12d ago · 2026-10-10 18:35 UTC
parent: 8523225
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +7 -3

M cmd/ermite/web_session_test.go +3 -1


@@ -127,7 +127,9 @@ func TestWebLoginEndToEnd(t *testing.T) {
127	127		p := b.get(path, nil)
128	128		assert.Equal(t, 200, p.status)
129	129		assert.Equal(t, "no-store", p.hdr.Get("Cache-Control"))
130		-	assert.Equal(t, "no-referrer", p.hdr.Get("Referrer-Policy"))
	130	+	// Only the origin leaves the page; no-referrer would make the browser
	131	+	// send Origin: null on the sign-in POST.
	132	+	assert.Equal(t, "strict-origin", p.hdr.Get("Referrer-Policy"))
131	133		assert.Contains(t, p.body, `method="post"`)
132	134		assert.Contains(t, p.body, `action="`+path+`"`)
133	135		assert.Nil(t, p.cookie(sessionCookie), "a GET sets no session")

 		p := b.get(path, nil)
 		assert.Equal(t, 200, p.status)
 		assert.Equal(t, "no-store", p.hdr.Get("Cache-Control"))
-		assert.Equal(t, "no-referrer", p.hdr.Get("Referrer-Policy"))
+		// Only the origin leaves the page; no-referrer would make the browser
+		// send Origin: null on the sign-in POST.
+		assert.Equal(t, "strict-origin", p.hdr.Get("Referrer-Policy"))
 		assert.Contains(t, p.body, `method="post"`)
 		assert.Contains(t, p.body, `action="`+path+`"`)
 		assert.Nil(t, p.cookie(sessionCookie), "a GET sets no session")

M internal/adapters/web/session.go +4 -2


@@ -193,11 +193,13 @@ func validNonce(s string) bool {
193	193		const nonceLen = 43
194	194
195	195		// secretPage writes a page of the login flow: never cached, and its address,
196		-	// which holds the link, is not sent along when the visitor follows a link.
	196	+	// which holds the link, is never sent along: strict-origin sends only the
	197	+	// origin. no-referrer would also turn the Origin of the sign-in POST into
	198	+	// "null" in browsers, which the POST gate refuses.
197	199		func (s Server) secretPage(w http.ResponseWriter, r http.Request, status int, c templ.Component) {
198	200		h := w.Header()
199	201		h.Set("Cache-Control", "no-store")
200		-	h.Set("Referrer-Policy", "no-referrer")
	202	+	h.Set("Referrer-Policy", "strict-origin")
201	203		s.write(r.Context(), w, r, status, c)
202	204		}
203	205

 const nonceLen = 43
 // secretPage writes a page of the login flow: never cached, and its address,
-// which holds the link, is not sent along when the visitor follows a link.
+// which holds the link, is never sent along: strict-origin sends only the
+// origin. no-referrer would also turn the Origin of the sign-in POST into
+// "null" in browsers, which the POST gate refuses.
 func (s *Server) secretPage(w http.ResponseWriter, r *http.Request, status int, c templ.Component) {
 	h := w.Header()
 	h.Set("Cache-Control", "no-store")
-	h.Set("Referrer-Policy", "no-referrer")
+	h.Set("Referrer-Policy", "strict-origin")
 	s.write(r.Context(), w, r, status, c)
 }