### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [October 22, 2018, 3:01pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/1 "2018-10-22T15:01:07Z")
## Feature
Make `Referrer-Policy: strict-origin-when-cross-origin` the default header.
Please change the default `Referrer-Policy header` to `strict-origin-when-cross-origin` that also covers the use-case of `no-referrer-when-downgrade` but works for e.g., comments embedding.
## Situation
[https://securityheaders.com/?q=https%3A%2F%2Fmeta.discourse.org&hide=on&followRedirects=on](https://securityheaders.com/?q=https%3A%2F%2Fmeta.discourse.org&hide=on&followRedirects=on)
… show that “There was a duplicate Referrer-Policy header.”
1. `Referrer-Policy strict-origin-when-cross-origin`
2. `Referrer-Policy no-referrer-when-downgrade`
Only one of those should be set. 1 is not referenced in Discourse’s code, but it seems to me the legitimate one to use since it acts as a superset of 2. 2 is referenced in the sample nginx configuration file at
>
In discourse\_docker:
```plaintext
root@ps /var/discourse # grep -i referrer templates/*.yml
templates/web.ssl.template.yml: from: /add_header Referrer-Policy 'no-referrer-when-downgrade';/m
templates/web.ssl.template.yml: add_header Referrer-Policy 'no-referrer-when-downgrade';
```
## What to do with it?
1. change line 264 of `config/nginx.sample.conf` in discourse
2. update the `web.ssl.template.yml` to match the change in discourse\_docker.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 23, 2018, 10:20am UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/2 "2018-10-23T10:20:18Z")
What are your feelings on this @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 23, 2018, 11:17am UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/3 "2018-10-23T11:17:15Z")
Does any of this relate to your CSP work @xrav3nz ?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [October 23, 2018, 12:50pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/4 "2018-10-23T12:50:11Z")
My guess is that your front server is adding the extra header.
---
### Author:  [@xrav3nz](https://meta.discourse.org/u/xrav3nz)
#### Post date: [October 23, 2018, 5:36pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/6 "2018-10-23T17:36:44Z")
Nope, I double checked by looking at some instances without the latest CSP changes.
The duplicated (`strict-origin-when-cross-origin`) seems to be a Rails default
>
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [October 23, 2018, 9:35pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/7 "2018-10-23T21:35:06Z")
Then removing line 264 should fix it?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 23, 2018, 9:36pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/8 "2018-10-23T21:36:32Z")
Sure, might as well remove it… doing so now
[https://github.com/discourse/discourse/commit/64aca0dc1be041459e4e8f70e031b44d3e6dbb73](https://github.com/discourse/discourse/commit/64aca0dc1be041459e4e8f70e031b44d3e6dbb73)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 23, 2018, 9:43pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/9 "2018-10-23T21:43:33Z")
Excellent, good find @hellekin 🍻
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [October 23, 2018, 9:44pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/10 "2018-10-23T21:44:49Z")
@sam don’t forget `discourse_docker` 🙂
Thanks @codinghorror.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 23, 2018, 9:57pm UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/11 "2018-10-23T21:57:08Z")
Thanks for reminding me 🙂
[https://github.com/discourse/discourse\_docker/commit/dcf44a6f57e4dd3d0f6f822aa6172e66991e74ea](https://github.com/discourse/discourse_docker/commit/dcf44a6f57e4dd3d0f6f822aa6172e66991e74ea)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 25, 2018, 7:00am UTC](https://meta.discourse.org/t/harden-referrer-policy-header/100172/12 "2018-10-25T07:00:01Z")
This topic was automatically closed after 33 hours. New replies are no longer allowed.