page: referrer policy to include details cross-origin

Default recently changed to strict-origin-when-cross-origin which hides path
details in Referer.  Disagree about this "security" and rather keep the page
information for external sites.

diff --git a/page.php b/page.php
index 8a37533f4c6e78e928980c5a92454f3e589be83d..9f9ce626b0236e7ee5a805911861828422ae8e83 100644 (file)
--- a/page.php
+++ b/page.php
@@ -50,6 +50,7 @@ header(sprintf('Content-Security-Policy: %s', implode('; ', [
        "base-uri 'self'", # only local pages
        "frame-ancestors 'none'", # prevent malicious embedding
 ])));
+header('Referrer-Policy: no-referrer-when-downgrade');
 
 $Page->place += [
        'user'  => $User->login ?: '',