Harden Referrer-Policy Header

feature
1

Feature

Make Referrer-Policy: strict-origin-when-cross-origin the default header.

Please change the default Referrer-Policy header to strict-origin-when-cross-origin that also covers the use-case of no-referrer-when-downgrade but works for e.g., comments embedding.

Situation

… show that “There was a duplicate Referrer-Policy header.”

  1. Referrer-Policy strict-origin-when-cross-origin
  2. Referrer-Policy no-referrer-when-downgrade

Only one of those should be set. 1 is not referenced in Discourse’s code, but it seems to me the legitimate one to use since it acts as a superset of 2. 2 is referenced in the sample nginx configuration file at
https://github.com/discourse/discourse/blob/99d1ded3b3a2767617bbee9824e93eb57f135864/config/nginx.sample.conf#L264

In discourse_docker:

root@ps /var/discourse # grep -i referrer templates/*.yml
templates/web.ssl.template.yml:     from: /add_header Referrer-Policy 'no-referrer-when-downgrade';/m
templates/web.ssl.template.yml:       add_header Referrer-Policy 'no-referrer-when-downgrade';

What to do with it?

  1. change line 264 of config/nginx.sample.conf in discourse
  2. update the web.ssl.template.yml to match the change in discourse_docker.
1 Like
2

What are your feelings on this @sam?

3

Does any of this relate to your CSP work @xrav3nz ?

2 Likes
4

My guess is that your front server is adding the extra header.

6

Nope, I double checked by looking at some instances without the latest CSP changes.

The duplicated (strict-origin-when-cross-origin) seems to be a Rails default

https://github.com/rails/rails/blob/14d3c7c2c9b89fe76a3677f99d102dd6ca729927/actionpack/lib/action_dispatch/railtie.rb#L33

4 Likes
7

Then removing line 264 should fix it?

8

Sure, might as well remove it… doing so now

https://github.com/discourse/discourse/commit/64aca0dc1be041459e4e8f70e031b44d3e6dbb73

2 Likes
9

Excellent, good find @hellekin :beers:

10

@sam don’t forget discourse_docker :slight_smile:

Thanks @codinghorror.

3 Likes
11

Thanks for reminding me :slight_smile:

https://github.com/discourse/discourse_docker/commit/dcf44a6f57e4dd3d0f6f822aa6172e66991e74ea

2 Likes
12

This topic was automatically closed after 33 hours. New replies are no longer allowed.