From abe0aa9ec668c01a089ed5b2e49dae022b42f546 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Thu, 9 Apr 2026 09:30:09 -0500
Subject: [PATCH] Pin referrer policy so OSM tile requests always send a
 Referer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OSM's tile usage policy requires a Referer header identifying the site.
strict-origin-when-cross-origin is the current browser default and sends
the origin on HTTPS→HTTPS cross-origin requests; pinning it explicitly
prevents silently losing the header if a browser default ever changes.
---
 lib/microwaveprop_web/components/layouts/root.html.heex | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/microwaveprop_web/components/layouts/root.html.heex b/lib/microwaveprop_web/components/layouts/root.html.heex
index 9e582bdb..1a2994b5 100644
--- a/lib/microwaveprop_web/components/layouts/root.html.heex
+++ b/lib/microwaveprop_web/components/layouts/root.html.heex
@@ -4,6 +4,14 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="csrf-token" content={get_csrf_token()} />
+    <%!--
+    OpenStreetMap's tile usage policy requires a Referer header identifying
+    the site using their tiles. strict-origin-when-cross-origin sends just
+    the origin (e.g. https://prop.w5isp.com) on cross-origin HTTPS requests,
+    which is the minimum OSM asks for. Explicit so we don't silently lose
+    the Referer if a future browser default changes.
+    --%>
+    <meta name="referrer" content="strict-origin-when-cross-origin" />
     <.live_title default="North Texas Microwave Society" suffix=" · NTMS">
       {assigns[:page_title]}
     </.live_title>