From a2ec19e10f8c2acaea472397ffdce75146248f38 Mon Sep 17 00:00:00 2001
From: Matt N <github@matthew.noorenberghe.com>
Date: Tue, 17 Apr 2018 07:01:00 -0700
Subject: [PATCH] Don't send the Referer header to other origins. (#1092)

Avoid leaking the Home Assistant domain name (which often contains a person's name/alias) in the Referer header for non-same-origin requests.
---
 index.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/index.html b/index.html
index 2dbe2ddc4a..e26d966fac 100644
--- a/index.html
+++ b/index.html
@@ -19,6 +19,7 @@
     <meta name="msapplication-square310x310logo" content="/static/icons/tile-win-310x310.png"/>
     <meta name="msapplication-TileColor" content="#3fbbf4ff"/>
     <meta name='mobile-web-app-capable' content='yes'>
+    <meta name='referrer' content='same-origin'>
     <meta name='viewport' content='width=device-width, user-scalable=no'>
     <meta name='theme-color' content='{{ theme_color }}'>
     <style>