Harden Referrer-Policy Header

hellekin · 22 באוקטובר,‏ 2018,‏ 3:01pm

Feature

Make Referrer-Policy: strict-origin-when-cross-origin the default header.

Please change the default Referrer-Policy header to strict-origin-when-cross-origin that also covers the use-case of no-referrer-when-downgrade but works for e.g., comments embedding.

Situation

https://securityheaders.com/?q=https%3A%2F%2Fmeta.discourse.org&hide=on&followRedirects=on

… show that “There was a duplicate Referrer-Policy header.”

Referrer-Policy strict-origin-when-cross-origin
Referrer-Policy no-referrer-when-downgrade

Only one of those should be set. 1 is not referenced in Discourse’s code, but it seems to me the legitimate one to use since it acts as a superset of 2. 2 is referenced in the sample nginx configuration file at

github.com/discourse/discourse

config/nginx.sample.conf

99d1ded3b


      
              # this means every file in public is tried first
              try_files $uri @discourse;
            }
          
            location /downloads/ {
              internal;
              alias $public/;
            }
          
            location @discourse {
              add_header Referrer-Policy 'no-referrer-when-downgrade';
              proxy_set_header Host $http_host;
              proxy_set_header X-Request-Start "t=${msec}";
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $thescheme;
              proxy_pass http://discourse;
            }
          
          }

In discourse_docker:

root@ps /var/discourse # grep -i referrer templates/*.yml
templates/web.ssl.template.yml:     from: /add_header Referrer-Policy 'no-referrer-when-downgrade';/m
templates/web.ssl.template.yml:       add_header Referrer-Policy 'no-referrer-when-downgrade';

What to do with it?

change line 264 of config/nginx.sample.conf in discourse
update the web.ssl.template.yml to match the change in discourse_docker.

codinghorror · 23 באוקטובר,‏ 2018,‏ 10:20am

What are your feelings on this @sam?

sam · 23 באוקטובר,‏ 2018,‏ 11:17am

Does any of this relate to your CSP work @xrav3nz ?

hellekin · 23 באוקטובר,‏ 2018,‏ 12:50pm

My guess is that your front server is adding the extra header.

xrav3nz · 23 באוקטובר,‏ 2018,‏ 5:36pm

Nope, I double checked by looking at some instances without the latest CSP changes.

The duplicated (strict-origin-when-cross-origin) seems to be a Rails default

github.com/rails/rails

actionpack/lib/action_dispatch/railtie.rb

14d3c7c2c


      
          config.action_dispatch.use_authenticated_cookie_encryption = false
          config.action_dispatch.use_cookies_with_metadata = false
          config.action_dispatch.perform_deep_munge = true
          
          config.action_dispatch.default_headers = {
            "X-Frame-Options" => "SAMEORIGIN",
            "X-XSS-Protection" => "1; mode=block",
            "X-Content-Type-Options" => "nosniff",
            "X-Download-Options" => "noopen",
            "X-Permitted-Cross-Domain-Policies" => "none",
            "Referrer-Policy" => "strict-origin-when-cross-origin"
          }
          
          config.action_dispatch.cookies_rotations = ActiveSupport::Messages::RotationConfiguration.new
          
          config.eager_load_namespaces << ActionDispatch
          
          initializer "action_dispatch.configure" do |app|
            ActionDispatch::Http::URL.tld_length = app.config.action_dispatch.tld_length
            ActionDispatch::Request.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
            ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge

hellekin · 23 באוקטובר,‏ 2018,‏ 9:35pm

Then removing line 264 should fix it?

sam · 23 באוקטובר,‏ 2018,‏ 9:36pm

Sure, might as well remove it… doing so now

codinghorror · 23 באוקטובר,‏ 2018,‏ 9:43pm

Excellent, good find @hellekin

hellekin · 23 באוקטובר,‏ 2018,‏ 9:44pm

@sam don’t forget discourse_docker

Thanks @codinghorror.

sam · 23 באוקטובר,‏ 2018,‏ 9:57pm

Thanks for reminding me

sam · 25 באוקטובר,‏ 2018,‏ 7:00am

This topic was automatically closed after 33 hours. New replies are no longer allowed.

נושא		תגובות	צפיות
Allow customization of Referrer-Policy Feature	3	1113	18 בינואר,‏ 2019
Set 'Referrer-Policy' => 'same-origin' Installation	4	1182	14 באוקטובר,‏ 2022
Option to remove the referrer for external links Feature	4	892	18 במאי,‏ 2022
No `Referer:`, no embedding Support	5	2229	16 בספטמבר,‏ 2020
Nginx as reverse proxy and Content Security Policy issue Installation nginx	8	2378	21 באוגוסט,‏ 2024

Harden Referrer-Policy Header

Feature

Situation

What to do with it?

נושאים קשורים