id: 84471c41-0394-4e55-a408-0a4fbd5f6fff title: serve omits the Referrer-Policy header that Pages sends globally state: closed labels:
- kind:security assignees: [] milestone: null created: 2026-10-27T19:38:02.842303681Z updated: 2026-10-27T19:53:10.582424410Z
Problem
hu13 serve does not send the Referrer-Policy: strict-origin-when-cross-origin header that the generated Pages _headers file applies to every path. Static responses are therefore not single-shape and can leak full internal URLs/paths as referrers.
Verified:
$ curl -I http://127.0.0.1:39444/
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 15806
X-Content-Type-Options: nosniff
Connection: close
No Referrer-Policy. src/build.rs HEADERS_FILE carries it for Pages; src/serve.rs respond/respond_file_head do not.
Fix
Send the same Referrer-Policy on static, 404, and inbox responses (or explicitly document why serve differs); add a header parity test.