The security floor in src/http/respond.ts (securityFloor) sets nosniff, Referrer-Policy, Permissions-Policy, HSTS and a CSP floor, but no Cross-Origin-Opener-Policy, so a page another site opens with window.open keeps a handle on the forge's window.
Done:
[ ] securityFloor sets cross-origin-opener-policy: same-origin when the responder did not set one, beside the other headers, with one line in its doc comment saying why.
[ ] A responder that set its own value keeps it (same rule as the others).
[ ] A test in the existing security-floor test file asserts the header on an HTML page, a JSON API answer and a 404, and that a preset value survives; it fails without the change.
[ ] Sign-in with a passkey and the OAuth consent page still work (they redirect, they do not rely on window.opener): say so in the pull, with the test that covers each.
Files: src/http/respond.ts, its test. Risk: an OAuth or Turnstile popup flow that relies on window.opener would break; if one exists, that route sets same-origin-allow-popups explicitly and the pull names it.
The security floor in
src/http/respond.ts(securityFloor) sets nosniff, Referrer-Policy, Permissions-Policy, HSTS and a CSP floor, but no Cross-Origin-Opener-Policy, so a page another site opens withwindow.openkeeps a handle on the forge's window.Done:
securityFloorsetscross-origin-opener-policy: same-originwhen the responder did not set one, beside the other headers, with one line in its doc comment saying why.window.opener): say so in the pull, with the test that covers each.Files:
src/http/respond.ts, its test. Risk: an OAuth or Turnstile popup flow that relies onwindow.openerwould break; if one exists, that route setssame-origin-allow-popupsexplicitly and the pull names it.