From b902ec63129dbdfa38cd33a4fdb7c60c123e798b Mon Sep 17 00:00:00 2001 From: Peter Stockings Date: Thu, 1 Oct 2026 20:57:04 +1000 Subject: [PATCH] Fix shared run map tile referrer policy --- app/__init__.py | 3 ++- tests/test_app.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/app/__init__.py b/app/__init__.py index d57c238..1c783fe 100644 --- a/app/__init__.py +++ b/app/__init__.py @@ -93,7 +93,8 @@ def create_app(config=None): response.headers["X-Frame-Options"] = "DENY" response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin" if request.path.startswith("/shared/runs/"): - response.headers["Referrer-Policy"] = "no-referrer" + # OSM tiles require a Referer; never include the share token in it. + response.headers["Referrer-Policy"] = "strict-origin" response.headers["X-Robots-Tag"] = "noindex, nofollow" return response diff --git a/tests/test_app.py b/tests/test_app.py index d75a801..78269e3 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -173,7 +173,7 @@ def test_public_run_link_copy_view_revoke_and_recreate(app): assert b"/u/runner" not in page.data assert (url.removeprefix("http://localhost") + "/data").encode() in page.data assert page.headers["X-Robots-Tag"] == "noindex, nofollow" - assert page.headers["Referrer-Policy"] == "no-referrer" + assert page.headers["Referrer-Policy"] == "strict-origin" data = anonymous.get(url + "/data") assert data.status_code == 200 assert data.json["segments"] == [[[-33, 151]]]