From 1270657ba0b345912ab8a86f27467d7788116ae7 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 24 Aug 2022 02:48:44 +0200 Subject: [PATCH] Issue #1975 - Follow-up: Enable Origin header on same-origin by default. I've used this setting without ill effects for weeks, including visiting many a cloudflare-backed site. There is no issue there. --- modules/libpref/init/all.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index c3a995814f..ec8e6d770f 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -1496,8 +1496,8 @@ pref("network.http.referer.XOriginTrimmingPolicy", 0); pref("network.http.referer.XOriginPolicy", 0); // Include an origin header on non-GET and non-HEAD requests regardless of CORS -// 0=never send, 1=send when same-origin only, 2=always send -pref("network.http.sendOriginHeader", 0); +// 0=never send, 1=send when same-origin only, 2=always send (careful!) +pref("network.http.sendOriginHeader", 1); // Controls whether referrer attributes in , , ,