Login

2026-10-23 17:10:31 -04:00
parent fa1568b0bd
commit ae25026d9f
2 changed files with 22 additions and 1 deletions
@@ -5,6 +5,9 @@ class SecurityHeaders:
    def __call__(self, request):
        response = self.get_response(request)
        response["Cache-Control"] = "no-store"
-        response["Referrer-Policy"] = "no-referrer"
+        # HTTPS form posts need their same-site origin/referrer for Django's
+        # CSRF checks. no-referrer can produce Origin: null in browsers.
+        # same-origin still withholds verification URLs from external sites.
+        response["Referrer-Policy"] = "same-origin"
        response["Content-Security-Policy"] = "default-src 'none'; style-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
        return response