silentmode/argus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gateway: no relay banner inside Theseus and Ariadne

Browse source 
They fetch pages through the path form and show them under the name's own
origin, so the banner warned about a gateway origin the page was not on.
This commit is contained in:
Local Dev 2026-10-06 22:05:50 +02:00
parent 53fd569b0d
commit 32d514ecc4
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/gateway/public-gateway.mjs
View file

@ -822,7 +822,12 @@ async function serve(res, name, reqPath, baseHref, req = null) {
// is injected only there. The trust chip is injected on BOTH forms (chip
// is purely informative and useful on mobile where URL bars hide the
// subdomain structure).
const htmlOpts = { pathForm: baseHref !== null, name, reqPath };
// Resolver clients (Theseus, Ariadne) fetch a page through the path form and
// show it under the name's own origin, so the relay chrome would be a false
// warning inside them. They say who they are with "x-bns-policy: client"; a
// browser navigation cannot send that header, so visitors still get it.
const fromClient = String(req?.headers?.["x-bns-policy"] || "").toLowerCase() === "client";
const htmlOpts = { pathForm: baseHref !== null, name: fromClient ? null : name, reqPath };
// Security headers for every HTML response below. Also strips the broad
// `access-control-allow-origin: *` set at the top of serve() — HTML pages
// being readable cross-origin is a surveillance surface (any site can