Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revert Referrer-Policy header commit. #842

Merged
merged 1 commit into from
Sep 29, 2023
Merged

Revert Referrer-Policy header commit. #842

merged 1 commit into from
Sep 29, 2023

Commits on Sep 29, 2023

  1. Revert Referrer-Policy header commit. 

    Although OWASP still recommends that reset password and confirmation links have the no-referrer header option set - this causes issues with HTTPS and Flask-WTF that requires a referrer header.
Also - for the past 5 years, the browser default for Referrer-Policy is 'strict-origin-when-cross-origin' which should be enough to mitigate any possible Referrer leakage.

closes #829
    @jwag956
    jwag956 committed Sep 29, 2023
    Configuration menu
    Copy the full SHA
    279fe9c View commit details
    Browse the repository at this point in the history