Update callback url check

Co-authored-by: Denis Arnst <git@sapd.eu>
2026-05-30 23:40:40 +02:00 · 2025-08-10 17:08:25 -05:00
parent 2116f60133
commit 99a3867ce9
3 changed files with 64 additions and 3 deletions
@@ -229,6 +229,10 @@ class Server {
        res.setHeader('Content-Security-Policy', "frame-ancestors 'self'")
      }

+      // Security: Prevent referrer leakage to protect against token exposure
+      // Using 'no-referrer' to completely prevent token leakage in referer headers
+      res.setHeader('Referrer-Policy', 'no-referrer')
+
      /**
       * @temporary
       * This is necessary for the ebook & cover API endpoint in the mobile apps