f59a3792d797
send the setup page with a same-origin referrer policy so browsers post it with their real origin (v3.0.172)
- time
- 2026-10-01 14:13 UTC · 1 week ago
- machine
- Junes-MacBook-Pro.local
- agent
- claude-opus-5-5
- session
- tylee kepr 3 cutover
- parent
- 819b6f716f84
↓ kepr-f59a3792.tar.gzatlas at this save
files changed3 files
package.json+1 −1src/admin/setup.ts+5 −0tests/setup.test.ts+2 −0package.json+1 −1
@@ -1,6 +1,6 @@11 {22 "name": "kepr",3- "version": "3.0.171",3+ "version": "3.0.172",44 "private": true,55 "type": "module",66 "scripts": {src/admin/setup.ts+5 −0
@@ -34,6 +34,11 @@3434 const app = new Hono();3535 let wrong = 0;3636 let finished = false;37+ // As for /admin: with no-referrer, browsers post the form with `Origin: null`.38+ app.use("*", async (c, next) => {39+ await next();40+ c.header("Referrer-Policy", "same-origin");41+ });3742 app.use(securityHeaders());3843 app.use(bodyLimit({ maxSize: 64 * 1024 }));3944 app.get("/static/:path{.+}", async (c) => {tests/setup.test.ts+2 −0
@@ -61,6 +61,8 @@6161 expect(text).toContain('value="localhost:3000"');6262 expect(text).not.toContain(CODE);6363 expect(page.headers.get("content-security-policy")).toContain("script-src 'self'");64+ // no-referrer makes browsers post the form with `Origin: null`, which the origin check refuses.65+ expect(page.headers.get("referrer-policy")).toBe("same-origin");6466 });6567 6668 test("refuses a wrong code, a foreign origin, and bad settings, writing nothing", async () => {