From 91efb6d988091937e33acd3f33ff0b221141daec Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 12 Sep 2026 10:43:32 +0200 Subject: [PATCH] Preserve browser Origin on the confirmed sign-out form Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- src/internal/server/oidc/account.go | 3 ++- src/internal/server/oidc/account_test.go | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/internal/server/oidc/account.go b/src/internal/server/oidc/account.go index 7fb30c9..59e35b6 100644 --- a/src/internal/server/oidc/account.go +++ b/src/internal/server/oidc/account.go @@ -47,7 +47,8 @@ Applications that already have their own sessions may remain signed in.

func (h *AccountLogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { w.Header().Set("Cache-Control", "no-store") - w.Header().Set("Referrer-Policy", "no-referrer") + // Keep the same-origin POST Origin; no-referrer makes Chromium send Origin: null. + w.Header().Set("Referrer-Policy", "same-origin") w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'") w.Header().Set("X-Content-Type-Options", "nosniff") switch r.Method { diff --git a/src/internal/server/oidc/account_test.go b/src/internal/server/oidc/account_test.go index cde654e..fb5dfa4 100644 --- a/src/internal/server/oidc/account_test.go +++ b/src/internal/server/oidc/account_test.go @@ -31,6 +31,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) { if w.Code != 200 || w.Header().Get("Location") != "" { t.Fatal("GET must only confirm") } + if w.Header().Get("Referrer-Policy") != "same-origin" { + t.Fatal("browser POST would lose its Origin") + } c := w.Result().Cookies()[0] if !c.Secure || !c.HttpOnly || c.Domain != "" { t.Fatal("unsafe CSRF cookie")