7b:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T834,## Description The client proxy copied the calling app's `Referer` and `Origin` headers onto the request it sends to qBittorrent. qBittorrent's WebUI CSRF check answers 401 when either header names a host other than its own, so an app that sends a `Referer` (the BookOrbit "Test connection" button, for example) could not use a client proxy URL, while apps that send none (Lidarr) worked. `rewriteRequest` now deletes both headers from the outbound request, right after `applyAuthHeaders`. qui is the qBittorrent client here and its own API calls send neither header, so proxied calls now look the same to qBittorrent. `RetryTransport` clones that outbound request for every attempt, so a request replayed after a session refresh also goes out without them. `TestProxyDropsClientRefererAndOrigin` sends requests through the handler to a test upstream that returns 401 on any `Referer` or `Origin`. It covers a `Referer`, a foreign `Origin`, no header, and a `Referer` on a request that gets the 403 of an expired session and is replayed after re-login. On develop the three header cases fail with 401. Fixes #3167 ## How has this been tested? No live run against a real qBittorrent instance. The closest check is the handler test above, whose upstream rejects the headers the way the CSRF check does. ## Performance No performance risk. Two header deletes per proxied request, no new allocations or I/O. ## Checklist - [x] My PR title follows the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) format (it becomes the squashed commit message) - [ ] If this changes the database schema, I have added migrations for both SQLite and PostgreSQL - [x] I completed the [mandatory performance checks](https://github.com/autobrr/qui/blob/develop/docs/agents/performance-checks.md) and recorded the outcome in Performance ## AI disclosure Yes. The fix and test were written with Claude Code (Claude Opus) from the issue brief. I confirmed the new test fails without the fix, and ran `go test -count=1 ./internal/proxy/`, `go vet` and `golangci-lint` on the package. 79:T16f4,

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

- **Configuration used**: Repository YAML (base), Repository UI (inherited) - **Review profile**: CHILL - **Plan**: Advanced - **Run ID**: `63d6062b-aeba-4af5-8e3b-66f86c30bb22`

📥 Commits

Reviewing files that changed from the base of the PR and between 332a5a5181816ab00cab424e362253d3e01cd09f and c7e618f23cf7c0b9a02a653c44a15676e43861c8.

📒 Files selected for processing: 2

* `internal/proxy/handler.go` * `internal/proxy/handler_test.go`

**Included review availability:** This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.

📝 Walkthrough

The proxy now removes `Referer` and `Origin` from outbound requests to qBittorrent. A new test covers requests with either header, requests without those headers, and a request replayed after an initial 403 response.

**Priority:** ➖ Normal **Severity of issue fixed:** Medium

Merge Risk: ⚪ Minimal · up to c7e61

Proxied requests to qBittorrent no longer carry the calling app's Referer or Origin, which avoids 401 rejections from foreign hosts. The change is small and covered by a handler test. No concrete merge risk was identified.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts Thanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=autobrr/qui&utm_content=3172)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout\-out.

❤️ Share

- [x] () - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment `@coderabbitai help` to get the list of available commands.} 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"autobrr","repo":"qui","pullNumber":3172}],"data":{"repositoryId":"291","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/92f293ba45b51b1a4b15067a359ca1c2?key=AVYsgVYMGwSez1AscmjXyyJTVtnmdbB3y4YWNflzy8fS%2FKE9yVJ%2FA0XekZr162vHeuTmSl9qspsk7TwWxV1ZI6%2BWYRiogGtAcxSKheXMHQvsY9PmPriEZf0qYHjbqzIX%2FwuFYZRBhC246KtGPjbm89Pl4wTscmGEj54lnuhMkUx%2BKo4ht2MzQfuB","externalProvider":"github","login":"thejdubb02","type":"User","url":"https://github.com/thejdubb02"},"authorId":"5132924","baseRefName":"develop","closedAt":null,"comments":2,"createdAt":"2026-10-13T23:34:23Z","headRefName":"unknown repository","id":"4935454","isDraft":false,"labels":[],"number":3172,"repository":{"name":"qui","owner":"autobrr","provider":"forgejo"},"state":"open","title":"fix(proxy): drop client Referer and Origin before forwarding to qBittorrent","updatedAt":"2026-10-13T23:36:24Z","url":"https://trylle.com/autobrr/qui/pulls/3172","body":"$78","additions":60,"deletions":0,"changedFiles":2,"commits":1,"reviewComments":1,"headSha":"c7e618f23cf7c0b9a02a653c44a15676e43861c8","baseSha":"6e86b3f1ffacdc258d3be197c374b5274f704894","headRepoOwner":"autobrr","headRepoName":"qui","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":false,"mergeableState":"checking","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:3172"},"comments":[{"id":26881405,"graphqlId":"26881405","body":"$79","createdAt":"2026-10-13T23:34:53Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/d39e0f17743c08d7bf625ba6f80c545a?key=Ac3dCIMfeEeTRToXUBeRdRfe7IGnH7FaknGcutnXETLNIDauVDMEeYfL%2BNJ1UW6PltLPYQ8AAbXVYTqKXZ2sbxmdR%2FJeAINpLPz%2Fgbhi3if42haJXKHU1rlVIjj4bCQzj6%2FWYhkNT360oU7wzsBjYZsV7FyaaYuuIlrb3O4TqxAm%2FsfmH46nFvfFacg%3D","externalProvider":"github","login":"coderabbitai[bot]","type":"Bot","url":"https://github.com/apps/coderabbitai"}}],"commits":[{"sha":"c7e618f23cf7c0b9a02a653c44a15676e43861c8","message":"fix(proxy): drop client Referer and Origin before forwarding to qBittorrent\n","createdAt":"2026-10-13T23:24:58Z","author":{"avatarUrl":"","login":"","name":"Justin Willhite","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[{"id":3607391,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/c291b4cd04a9c3802ca3daabab2434e1?key=AXmRlCyY2W1JdckSbcUZ2qy5WV0vFrxRo7pfarKIBb7kCz%2BaTucDH0OerwPykpyVT3xq6J%2B70sw0FZ%2BIJnVeom8m3eEQD8xNPyPIebBhXuv7TC6HG0ycsOnhBG4SA%2BRZEMBvNPuv%2BCHiVgR28auVlGPgkULGXf%2FUhOpMBOj74MH3Kxac%2FWcu7TyVkA%3D%3D","externalProvider":"github","login":"s0up4200","type":"User","url":"https://github.com/s0up4200"},"submittedAt":"2026-10-13T23:34:23Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":2,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793412623030}],"children":"$L7a"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix(proxy): drop client Referer and Origin before forwarding to qBittorrent · autobrr/qui | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix(proxy): drop client Referer and Origin before forwarding to qBittorrent (#3172) in autobrr/qui."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix(proxy): drop client Referer and Origin before forwarding to qBittorrent · autobrr/qui, autobrr/qui, autobrr/qui repository, qui, Go repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/autobrr/qui/pulls/3172/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/autobrr/qui/pulls/3172/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix(proxy): drop client Referer and Origin before forwarding to qBittorrent · autobrr/qui | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix(proxy): drop client Referer and Origin before forwarding to qBittorrent (#3172) in autobrr/qui."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/autobrr/qui/pulls/3172/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=autobrr&repo=qui"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=autobrr&repo=qui"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"autobrr/qui repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix(proxy): drop client Referer and Origin before forwarding to qBittorrent · autobrr/qui | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix(proxy): drop client Referer and Origin before forwarding to qBittorrent (#3172) in autobrr/qui."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=autobrr&repo=qui"}],["$","meta","32",{"name":"twitter:image:alt","content":"autobrr/qui repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7b","36",{}]]

Commits on Tue, Oct 13, 2026