From ba8fc451c0650617bf88eaeca36c13d877a66064 Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Fri, 15 May 2026 13:29:32 -0400
Subject: [PATCH] seo: mark /join-or-log-in as crawler-unfriendly + no Referer
 leakage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Google Search Console flagged six /join-or-log-in?next=... URLs as
"Duplicate without user-selected canonical" — every ?next= permutation
serves identical content, so Google groups them as duplicates and
indexes none. Auth pages have no business in the index anyway, and
the ?next= query string can carry private cart/product paths that
shouldn't end up in crawl logs or Referer headers.

Two-pronged fix:

  templates/join-or-log-in.j2
    - <meta name="robots" content="noindex,nofollow"> drops the page
      and its outbound links from the index entirely.
    - <meta name="referrer" content="no-referrer"> stops the URL —
      with its ?next= cart-uuid / product-uuid contents — from leaking
      to any third party when the user clicks an outbound link.
    - Explicit <title>Log in or join</title> via the head block so
      the default {{ request.domain }} title isn't shown either.

  views/misc.py — DEFAULT_ROBOTS_DOT_TXT
    - Disallow: /join-or-log-in so crawlers don't fetch the URL in
      the first place. Pages already in the index will drop out once
      Google re-crawls and sees the noindex header.

Operator shops can still override robots_dot_txt in pillar config;
they get the same default unless they explicitly opt out.
---
 make_post_sell/templates/join-or-log-in.j2 | 12 ++++++++++++
 make_post_sell/views/misc.py               |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/make_post_sell/templates/join-or-log-in.j2 b/make_post_sell/templates/join-or-log-in.j2
index ca7e20e..ab57f06 100644
--- a/make_post_sell/templates/join-or-log-in.j2
+++ b/make_post_sell/templates/join-or-log-in.j2
@@ -1,4 +1,16 @@
 {% extends "base.j2" -%}
+{%- block append_to_head_tag_section %}
+  <title>Log in or join</title>
+  {# Auth gateway — every ?next=... permutation serves identical content,
+     which Google Search Console flagged as "Duplicate without
+     user-selected canonical". noindex,nofollow keeps the auth page out
+     of the index entirely (it has no business being indexed); the
+     no-referrer policy stops the URL — which can contain private
+     cart/product paths in ?next= — from leaking via Referer when the
+     user clicks any outbound link. #}
+  <meta name="robots" content="noindex,nofollow" />
+  <meta name="referrer" content="no-referrer" />
+{%- endblock append_to_head_tag_section %}
 {% block content -%}
 <section class="one-column">
   <section class="login-card elevation-3 animate-fade-in-up">
diff --git a/make_post_sell/views/misc.py b/make_post_sell/views/misc.py
index 942dfbd..b0299a3 100644
--- a/make_post_sell/views/misc.py
+++ b/make_post_sell/views/misc.py
@@ -16,7 +16,7 @@ from make_post_sell.lib.render import markdown_to_html
 
 DEFAULT_ROBOTS_DOT_TXT = """
 User-agent: *
-Disallow:
+Disallow: /join-or-log-in
 """