From b6955acf6f4b38dc2a348c424042159e52328685 Mon Sep 17 00:00:00 2001 From: Josh Sokol Date: Fri, 13 Nov 2026 11:25:19 -0600 Subject: [PATCH 1/2] Let the app own Referrer-Policy; stop the vhost sending a conflicting one (SR-2589) default-ssl.conf set 'no-referrer-when-downgrade' with Header always set, while the application's add_security_headers() sends 'origin'. The two landed in different header tables, so responses carried two conflicting Referrer-Policy headers, and the weaker Apache value sends the full URL (query string included) to https destinations. Use setifempty (normal table, no 'always') so the app's value is the only one on application responses and 'origin' still covers responses the app did not set. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_017PYHoHdrQpH48n8vnAKQR8 --- .../common/etc/apache2/sites-enabled/default-ssl.conf | 5 ++++- simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf index 45dbc28e..2ee10b34 100644 --- a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf +++ b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf @@ -43,7 +43,10 @@ SSLStrictSNIVHostCheck Off Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" Header always set X-Xss-Protection "1; mode=block" - Header always set Referrer-Policy "no-referrer-when-downgrade" + # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends + # `origin`. A header set here with `always` is emitted in addition to the app's, giving two + # conflicting values. setifempty only fills it in for responses the app did not set (static files). + Header setifempty Referrer-Policy "origin" Header always unset X-Powered-By Header unset X-Powered-By Header always unset X-Generator diff --git a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf index 0ce86b99..46b3ade5 100644 --- a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf +++ b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf @@ -19,7 +19,10 @@ SSLStrictSNIVHostCheck Off Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" Header always set X-Xss-Protection "1; mode=block" - Header always set Referrer-Policy "no-referrer-when-downgrade" + # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends + # `origin`. A header set here with `always` is emitted in addition to the app's, giving two + # conflicting values. setifempty only fills it in for responses the app did not set (static files). + Header setifempty Referrer-Policy "origin" Header always unset X-Powered-By Header unset X-Powered-By Header always unset X-Generator From 6683966a73ae25b5d465b4d2c410ccc90a1c3574 Mon Sep 17 00:00:00 2001 From: Josh Sokol Date: Fri, 13 Nov 2026 14:42:28 -0600 Subject: [PATCH 2/2] Stop forcing HSTS and X-XSS-Protection from the vhost (SR-2589) The app sends both when an admin enables them (add_security_headers()); the vhost's 'always set' copies ignored those settings and duplicated the headers. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_017PYHoHdrQpH48n8vnAKQR8 --- .../common/etc/apache2/sites-enabled/default-ssl.conf | 2 -- simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf | 2 -- 2 files changed, 4 deletions(-) diff --git a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf index 2ee10b34..9b6fd3de 100644 --- a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf +++ b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf @@ -41,8 +41,6 @@ SSLStrictSNIVHostCheck Off # combined format above does not carry. CustomLog /var/log/apache2/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" - Header always set X-Xss-Protection "1; mode=block" # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends # `origin`. A header set here with `always` is emitted in addition to the app's, giving two # conflicting values. setifempty only fills it in for responses the app did not set (static files). diff --git a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf index 46b3ade5..1ac9d19e 100644 --- a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf +++ b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf @@ -17,8 +17,6 @@ SSLStrictSNIVHostCheck Off SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown CustomLog /var/log/apache2/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" - Header always set X-Xss-Protection "1; mode=block" # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends # `origin`. A header set here with `always` is emitted in addition to the app's, giving two # conflicting values. setifempty only fills it in for responses the app did not set (static files).