From cff7d967f97b5119f9cf68f84973a8e36ec9d7c6 Mon Sep 17 00:00:00 2001 From: Claire Date: Tue, 10 Jan 2023 14:33:40 +0100 Subject: [PATCH] Fix CSRF protection (#23037) Fix regression from #23014 --- config/environments/production.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/environments/production.rb b/config/environments/production.rb index abb46bd16..99c9bb40c 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -138,7 +138,7 @@ Rails.application.configure do 'X-Content-Type-Options' => 'nosniff', 'X-XSS-Protection' => '0', 'Permissions-Policy' => 'interest-cohort=()', - 'Referrer-Policy' => 'no-referrer', + 'Referrer-Policy' => 'same-origin', } config.x.otp_secret = ENV.fetch('OTP_SECRET')