From bd131f024f5f1737a99c466afa6567902bb15354 Mon Sep 17 00:00:00 2001
From: Rikiya Narita <b2560305@planet.kanazawa-it.ac.jp>
Date: Sat, 25 Jul 2026 03:04:28 +0900
Subject: [PATCH] fix(security): reliably set Referrer-Policy: same-origin on
 the login page

The <If> matched %{REQUEST_URI} against m#/login$#, which sees the
post-rewrite URI, so with the front-controller rewrite active /login fell
through to the <Else> branch and got Referrer-Policy: no-referrer. It also
failed for /login/ and /index.php/login. Match %{THE_REQUEST} instead so the
login page reliably gets same-origin.

Fixes #60464

Signed-off-by: Rikiya Narita <b2560305@planet.kanazawa-it.ac.jp>
---
 .htaccess | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.htaccess b/.htaccess
index 32060738ab193..e0abf36ba8b9a 100644
--- a/.htaccess
+++ b/.htaccess
@@ -18,7 +18,7 @@
         # Avoid doubled headers by unsetting headers in "onsuccess" table,
         # then add headers to "always" table: https://github.com/nextcloud/server/pull/19002
 
-        <If "%{REQUEST_URI} =~ m#/login$#">
+        <If "%{THE_REQUEST} =~ m#\s/(index\.php/)?login/?[\s?]#">
             # Only on the login page we need any Origin or Referer header set.
             Header onsuccess unset Referrer-Policy
             Header always set Referrer-Policy "same-origin"