Zareian d5dbd1b23d keep the Referer on the redirect to Zarinpal so StartPay accepts our domain ...

A test payment on 2026-10-01 stopped at StartPay with "access from this
domain is not allowed". The app opens /api/payment/orders/{id}/pay, which
302s to Zarinpal, and that response carried Django's default
Referrer-Policy: same-origin, so the browser dropped the Referer on the
cross-site hop and Zarinpal could not see tadrisino2.ir. Only this view now
sends strict-origin-when-cross-origin (origin only, no path or query);
every other response keeps same-origin.

Not yet confirmed by a second real attempt in a browser.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-01 08:56:13 +03:30

34 KiB

Raw Blame History

View Raw