From 32d514ecc4d980c4667e6c8686b1d20ccd45151e Mon Sep 17 00:00:00 2001 From: Local Dev Date: Tue, 6 Oct 2026 22:05:50 +0200 Subject: [PATCH] gateway: no relay banner inside Theseus and Ariadne They fetch pages through the path form and show them under the name's own origin, so the banner warned about a gateway origin the page was not on. --- src/gateway/public-gateway.mjs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs index 28657bf..6f74112 100644 --- a/src/gateway/public-gateway.mjs +++ b/src/gateway/public-gateway.mjs @@ -822,7 +822,12 @@ async function serve(res, name, reqPath, baseHref, req = null) { // is injected only there. The trust chip is injected on BOTH forms (chip // is purely informative and useful on mobile where URL bars hide the // subdomain structure). - const htmlOpts = { pathForm: baseHref !== null, name, reqPath }; + // Resolver clients (Theseus, Ariadne) fetch a page through the path form and + // show it under the name's own origin, so the relay chrome would be a false + // warning inside them. They say who they are with "x-bns-policy: client"; a + // browser navigation cannot send that header, so visitors still get it. + const fromClient = String(req?.headers?.["x-bns-policy"] || "").toLowerCase() === "client"; + const htmlOpts = { pathForm: baseHref !== null, name: fromClient ? null : name, reqPath }; // Security headers for every HTML response below. Also strips the broad // `access-control-allow-origin: *` set at the top of serve() — HTML pages // being readable cross-origin is a surveillance surface (any site can