proxy: strip upstream Referrer-Policy — no-referrer (from the 7/22 fleet CSP sweep) blinded the referer-based asset escape hatch, previews rendered unstyled

d7674a96e74733b9e2bc8b7beebb40f77516f58b · 2026-07-22 21:00:27 -0700 · Steve Abrams

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit d7674a96e74733b9e2bc8b7beebb40f77516f58b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 21:00:27 2026 -0700

    proxy: strip upstream Referrer-Policy — no-referrer (from the 7/22 fleet CSP sweep) blinded the referer-based asset escape hatch, previews rendered unstyled
    
    Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server.js b/server.js
index 2334ca2..889b272 100644
--- a/server.js
+++ b/server.js
@@ -99,6 +99,9 @@ const server = http.createServer(async (req, res) => {
       delete h['x-frame-options'];
       delete h['content-security-policy'];
       delete h['strict-transport-security'];
+      // The root-relative asset escape hatch below routes by Referer; an upstream
+      // no-referrer policy would blind it and every /assets/* request would 404.
+      delete h['referrer-policy'];
       delete h.connection;
       if (h.location) {
         try {

← 12882d2 5x fleet: 5-sweep report — 47/47 clean, CSP/schema/asset fix · back to Agentabrams Viewer · viewer: follow redirects + detect login-form/SSO gating, not 1eb9bf1 →