web: Referrer-Policy same-origin; a password shown once emptied on pagehide

D-B3. Fetch Standard § 3.2 "append a request `Origin` header": under
Referrer-Policy no-referrer a request that is not GET/HEAD and not CORS -
a form POST, a navigation - gets Origin "null". originAllowed() refuses
"null" whenever Sec-Fetch-Site is absent, and Fetch Metadata § 3 sends
Sec-Fetch-Site only to a potentially trustworthy URL: every form,
sign-in included, failed in Safari before 16.4 and in any browser on a
plain-HTTP panel at a name. same-origin nulls Origin only for a request
not same origin with its URL and still sends no referrer to another
site. The comments of the origin check say so.

D-B13. noStore keeps the page out of HTTP caches (RFC 9111 § 5.2.2.5);
a history mechanism "might honor" it (§ 6), and Pragma in a response
"was never specified" (§ 5.4) - it goes. CopyField.Secret marks the
password of out-app-created data-secret, and panel.js empties such
fields on pagehide (HTML § 7.5.9, "unload a Document", step 10.2: fired
whether or not the document is kept for history traversal).

Measured 2026-10-15 in Chrome 152 (the desktop app's browser), a local
probe page with Cache-Control: no-store and a data-secret field: Back
reloads it (pageshow persisted=false, a new load), so this browser keeps
no-store pages out of its back/forward cache; the handler, fired on the
same page, empties the field. Firefox and Safari not measured.

Tests: the header value; the created page has the password data-secret
and the login not, no Pragma. Stand (2026-10-15, make e2e, exit 0): new
form_post_with_the_browsers_origin - Referrer-Policy: same-origin on a
page; a POST carrying the page's own Origin and no Sec-Fetch-Site, what
a browser sends now, passes; one carrying Origin: null, what it sent
before, is 403. (A first run failed where the e2e client and a view test
scraped the old input markup; both read data-secret now.) go vet and go
test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/security.go

@@ -65,10 +65,17 @@ func (s *Server) secure(next http.Handler) http.Handler {
 		// CSP3 § 6.4.2.2: 'none' is DENY, and where frame-ancestors is
 		// enforced X-Frame-Options is ignored.
 		h.Set("X-Frame-Options", "DENY")
-		// The panel's behaviour never depends on the referrer, so the strictest
-		// value is free: panel URLs carry domain names and record identifiers
-		// that need not leak to anything the administrator clicks through to.
-		h.Set("Referrer-Policy", "no-referrer")
+		// Panel URLs carry domain names and record identifiers that need not
+		// leak to anything the administrator clicks through to: same-origin
+		// sends no referrer to another site. Not no-referrer, which the
+		// origin check below depends on: under it a browser sends a form
+		// POST - a navigation - with Origin: null, refused whenever
+		// Sec-Fetch-Site is absent (Safari before 16.4, any browser over
+		// plain HTTP at a name). Fetch Standard § 3.2 "append a request
+		// `Origin` header": "no-referrer" sets the serialised origin to null;
+		// "same-origin" does so only when the request is not same origin
+		// with its URL (assumptions D-B3).
+		h.Set("Referrer-Policy", "same-origin")
 		if s.cfg.CookieSecure {
 			h.Set("Strict-Transport-Security", strictTransportSecurity)
 		}
@@ -131,8 +138,9 @@ func originAllowed(r *http.Request) bool {
 	// Older browsers send only Origin, and so does a current one over plain
 	// HTTP at a name other than localhost: Fetch Metadata § 3 appends its
 	// headers only for a potentially trustworthy URL. Fetch Standard § 3.2: a
-	// request that is neither GET nor HEAD carries Origin. (Which value it
-	// carries under this panel's Referrer-Policy: assumptions-2026-10-14, D-B3.)
+	// request that is neither GET nor HEAD carries Origin, and under this
+	// panel's Referrer-Policy, same-origin, it is the page's own origin for a
+	// form of the panel (§ 3.2; assumptions-2026-10-14, D-B3).
 	// Compare hosts, not full origins: the panel speaks plain HTTP behind the
 	// proxy and does not know its own external scheme, while Origin will say
 	// https.
@@ -154,7 +162,8 @@ func originAllowed(r *http.Request) bool {
 		// Fetch Standard § 2.2.5 "serializing a request origin": "null" for a
 		// redirect-tainted request; HTML § 7.1.1: an opaque origin serialises
 		// to "null"; url.Parse("null") has no Host. (Fetch § 3.2 also sends
-		// "null" under Referrer-Policy no-referrer: D-B3 of the same register.)
+		// "null" under Referrer-Policy no-referrer, which this panel therefore
+		// does not set: D-B3 of the same register.)
 		return false
 	}
 	return u.Host == r.Host