Fix for cross-site navigation block on default settings

Simbiat · Dec 19, 2021 · 0818153 · 0818153
1 parent 288063d
commit 0818153
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/HTTP20/Headers.php b/src/HTTP20/Headers.php
@@ -339,8 +339,8 @@ public function secFetch(array $site = [], array $mode = [], array $user = [], a
                 #Setting defaults
                 $site = array_intersect($site, self::fetchSite);
                 if (empty($site)) {
-                    #Allows only same-origin (site and subdomain) or top-navigation
-                    $site = ['same-origin', 'none'];
+                    #Allow everything, but stick to same port for "same" (same-origin, but not same-site)
+                    $site = ['cross-site', 'same-origin', 'none'];
                 }
                 $mode = array_intersect($mode, self::fetchMode);
                 if (empty($mode)) {