Repository navigation
Let the app own Referrer-Policy (SR-2589) - #185
Merged
Merged
Conversation
… one (SR-2589) default-ssl.conf set 'no-referrer-when-downgrade' with Header always set, while the application's add_security_headers() sends 'origin'. The two landed in different header tables, so responses carried two conflicting Referrer-Policy headers, and the weaker Apache value sends the full URL (query string included) to https destinations. Use setifempty (normal table, no 'always') so the app's value is the only one on application responses and 'origin' still covers responses the app did not set. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PYHoHdrQpH48n8vnAKQR8
The app sends both when an admin enables them (add_security_headers()); the vhost's 'always set' copies ignored those settings and duplicated the headers. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PYHoHdrQpH48n8vnAKQR8
jsokol
marked this pull request as ready for review
November 13, 2026 20:48
jsokol
enabled auto-merge (squash)
November 13, 2026 20:48
jsokol
disabled auto-merge
November 13, 2026 20:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
SR-2589: responses carried two
Referrer-Policyheaders. The Apache vhost setno-referrer-when-downgradewithHeader always set, and the SimpleRisk app sends its ownReferrer-Policy: originvia PHPheader(). The two use different header tables, so both reached the client and browsers combined them unpredictably.The app owns the header, so the vhost now uses
Header setifempty Referrer-Policy "origin". It fills the header only when the app did not send one (for example static files), and never adds a second value. Applied to bothsimpleriskandsimplerisk-minimaldefault-ssl.conf.Also removed from both vhosts:
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"andHeader always set X-Xss-Protection "1; mode=block". The app already sends these when an admin enables them, so the vhost copies ignored the admin settings and duplicated the headers (X-XSS-Protection was returned twice). A forced two-yearincludeSubdomains; preloadHSTS is risky for HTTP, reverse-proxy and shared-domain installs, and X-XSS-Protection is obsolete.Trade-off
Static files the app never touches no longer get HSTS from Docker. Browsers apply HSTS per host, so HTML responses carrying it are enough.
setifemptywithoutalwaysdoes not apply to responses Apache generates itself (non-2xx error pages), so those lose the header.Testing
apachectl -twas not run. Apache 2.4.58 supportssetifempty.Referrer-Policy: originheader on application responses.🤖 Generated with Claude Code
https://claude.ai/code/session_017PYHoHdrQpH48n8vnAKQR8