---
id: 84471c41-0394-4e55-a408-0a4fbd5f6fff
title: serve omits the Referrer-Policy header that Pages sends globally
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T19:38:02.842303681Z
updated: 2026-10-27T19:53:10.582424410Z
---
## Problem

`hu13 serve` does not send the `Referrer-Policy: strict-origin-when-cross-origin` header that the generated Pages `_headers` file applies to every path. Static responses are therefore not single-shape and can leak full internal URLs/paths as referrers.

Verified:

```
$ curl -I http://127.0.0.1:39444/
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 15806
X-Content-Type-Options: nosniff
Connection: close
```

No `Referrer-Policy`. `src/build.rs` `HEADERS_FILE` carries it for Pages; `src/serve.rs` `respond`/`respond_file_head` do not.

## Fix

Send the same `Referrer-Policy` on static, 404, and inbox responses (or explicitly document why `serve` differs); add a header parity test.