TYPO3 Core

• Probably Referrer-Policy: same-origin is fine and not causing these issues (given that there is not origin change during login)
• Please post the relevant parts of your nginx proxy setup (protocols, method, ports, names would be most interesting here)
• Are referrer headers manipulated somehow, e.g. custom rules like http://nginx.org/en/docs/http/ngx_http_referer_module.html
• Please post the relevant settings used in LocalConfiguration.php for SYS/reverseProxy* properties

As a work-around it is possible to disable enforcing referrers like described in https://typo3.org/security/advisory/typo3-core-sa-2020-006 - however, it would be great to sort out the reasons for this scenario. Thanks in advance for your feedback!

Hi,

first of all, there is no protocol or domain change, so i agree that Referrer-Policy: same-origin should fit.

The nginx reverse proxy config is attached as file. The relevant includes are also attached. Not needed anymore, see below.
I do not manipulate or touch the Referrer in any way.

This is the part of my LocalConfiguration.php

        'reverseProxyIP' => 'fd00:21:1::116',
        'reverseProxyHeaderMultiValue' => 'first',
        'reverseProxySSL' => '*',
        'trustedHostsPattern' => 'abnahme.mydomain.de',

Ahh - i entered the wrong IP address here. 116 is the typo3 container itself, the nginx reverse proxy is 101. :x
I changed it and now it works... stupid Layer 8. :s

So for now, the problem seems to be solved. If not, i will report it here.
Sorry for that issue and thanks for your help - it seems that i do not see the wood for the trees.

Thanks for your feedback and don't worry. Having the reverse proxy configuration here is actually a good thing to help others having a similar issue.