From c391be80e5109a490f392cea459195b6e472fe64 Mon Sep 17 00:00:00 2001
From: Bruno Charest <bruno.charest@gmail.com>
Date: Wed, 30 Sep 2026 21:22:33 -0400
Subject: [PATCH] fix(shorts): aligner referrerpolicy de l'iframe sur /watch
 (origin)

L'iframe Shorts utilisait referrerpolicy=strict-origin-when-cross-origin
alors que /watch utilise 'origin'. C'est la seule difference restante entre
les deux pages pour Dailymotion (URL identique, allow_embed=true) et elle
fait repondre 'Forbidden' au player. On aligne sur 'origin'.

Revert du referrerPolicy helmet (no-op pour les iframes qui ont leur propre
attribut, risque de side-effects inutile sur les CDN de vignettes).
---
 server/index.mjs                                 | 6 ------
 src/components/shorts/watch-short.component.html | 2 +-
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/server/index.mjs b/server/index.mjs
index 7578849..e293964 100644
--- a/server/index.mjs
+++ b/server/index.mjs
@@ -957,12 +957,6 @@ app.use(helmet({
   crossOriginEmbedderPolicy: false,
   // Allow loading cross‑origin images
   crossOriginResourcePolicy: { policy: 'cross-origin' },
-  // Dailymotion exige un Referer sur la page d'embed (sans lui, le player
-  // bloque la lecture). Le défaut helmet (`no-referrer`) coupait le Referer
-  // de toute la page : on envoie l'origine (recommandation Dailymotion
-  // "Referrer policy and Player embedding", valeur par défaut des navigateurs
-  // depuis 2021). Les iframes précisent déjà leur propre referrerpolicy.
-  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
 }));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
diff --git a/src/components/shorts/watch-short.component.html b/src/components/shorts/watch-short.component.html
index 4222fc5..6485f40 100644
--- a/src/components/shorts/watch-short.component.html
+++ b/src/components/shorts/watch-short.component.html
@@ -79,7 +79,7 @@
         @if (embedUrl(); as url) {
           <iframe [src]="url" [title]="current()?.title || 'Short video'" class="absolute inset-0 w-full h-full" frameborder="0" playsinline
                   allow="accelerometer; autoplay; clipboard-write; encrypted-media; fullscreen; gyroscope; picture-in-picture; web-share"
-                  allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>
+                  allowfullscreen referrerpolicy="origin"></iframe>
         } @else if (loading()) {
           <div class="absolute inset-0 flex flex-col gap-3 items-center justify-center bg-black text-slate-400 text-sm">
             <div class="h-8 w-8 rounded-full border-2 border-slate-600 border-t-red-500 animate-spin" aria-hidden="true"></div>