From 3d3330bcbfb9ca7d6388808ebcaea28cac27e2e3 Mon Sep 17 00:00:00 2001
From: Ashwin <ashwin@micropyramid.com>
Date: Fri, 2 Oct 2026 09:53:33 +0530
Subject: [PATCH] fix: update referrer policy to same-origin for CSRF
 protection

---
 frontend/src/routes/(no-layout)/login/verify/+page.svelte | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/frontend/src/routes/(no-layout)/login/verify/+page.svelte b/frontend/src/routes/(no-layout)/login/verify/+page.svelte
index 8d049fda..04fdd672 100644
--- a/frontend/src/routes/(no-layout)/login/verify/+page.svelte
+++ b/frontend/src/routes/(no-layout)/login/verify/+page.svelte
@@ -12,7 +12,11 @@
 
 <svelte:head>
   <title>Sign in · BottleCRM</title>
-  <meta name="referrer" content="no-referrer" />
+  <!-- same-origin, not no-referrer: under no-referrer the browser sends
+       `Origin: null` on the form POST, and SvelteKit's CSRF check refuses it
+       as cross-site (403). same-origin still keeps the token in this URL out of
+       any Referer sent to another site. -->
+  <meta name="referrer" content="same-origin" />
 </svelte:head>
 
 <div class="v2-root v2-auth">