Skip to content

[Bug]: Referrer leaks #2708

@WGH-

Description

@WGH-

What happened?

The frontend loads images from https://www.zigbee2mqtt.io/, leaking the intranet address to a third party in Origin and Referer headesrs:

GET /images/devices/SNZB-02P.png HTTP/2
Host: www.zigbee2mqtt.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en,ru;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Origin: http://<REDACTED>:8080
Connection: keep-alive
Referer: http://<REDACTED>:8080/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Priority: u=4, i
Pragma: no-cache
Cache-Control: no-cache

What browsers are you seeing the problem on?

Firefox

Relevant stacktrace

Did you download state.json.zip?

I will not attach state.json.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions