#115 serve omits the Referrer-Policy header that Pages sends globally
Problem
hu13 serve does not send the Referrer-Policy: strict-origin-when-cross-origin header that the generated Pages _headers file applies to every path. Static responses are therefore not single-shape and can leak full internal URLs/paths as referrers.
Verified:
$ curl -I http://127.0.0.1:39444/
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 15806
X-Content-Type-Options: nosniff
Connection: close
No Referrer-Policy. src/build.rs HEADERS_FILE carries it for Pages; src/serve.rs respond/respond_file_head do not.
Fix
Send the same Referrer-Policy on static, 404, and inbox responses (or explicitly document why serve differs); add a header parity test.
Uunknown ·
Fixed in PR #61 (
3df93c3a-bd5e-43f4-bb73-0f3dd886eeb1, commitee6e71b, mergede834a46). CI run2026-10-27T19-50-04.907798288Zpassed; fullcargo test,node --test tests/pages_inbox.test.mjs, fmt, and clippy green.servenow sendsReferrer-Policy: strict-origin-when-cross-originon static, 404, inbox, and streamed responses.serve_404_headers_and_bundle_symlinks_are_safeasserts it on 200 and 404 responses.