From 3861d3302e184cbe9058ab5b0fac11d1d7d13bba Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Mon, 19 May 2025 14:18:07 +0200
Subject: [PATCH] Fix bounce issue with Safari

---
 docs/example-advanced.nginx.conf | 1 +
 lib/defaults.js                  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf
index 2aeb31cbc..b33c37e51 100644
--- a/docs/example-advanced.nginx.conf
+++ b/docs/example-advanced.nginx.conf
@@ -104,6 +104,7 @@ server {
     # Enable SharedArrayBuffer in Firefox (for .xlsx export)
     add_header Cross-Origin-Resource-Policy cross-origin;
     add_header Cross-Origin-Embedder-Policy require-corp;
+    add_header Referrer-Policy same-origin;
 
     # Insert the path to your CryptPad repository root here
     root /home/cryptpad/cryptpad;
diff --git a/lib/defaults.js b/lib/defaults.js
index 3d342a659..f4942dec6 100644
--- a/lib/defaults.js
+++ b/lib/defaults.js
@@ -57,6 +57,7 @@ Default.httpHeaders = function (Env) {
         "X-XSS-Protection": "1; mode=block",
         "X-Content-Type-Options": "nosniff",
         "Access-Control-Allow-Origin": Env.enableEmbedding? '*': Env.permittedEmbedders,
+        "Referrer-Policy": "same-origin",
         "Permissions-policy":"interest-cohort=()"
     };
 };