feat(SecurityHeaders): add Referrer-Policy override

__tests__/server/config/env/runTime.spec.js

@@ -385,4 +385,17 @@ describe('runTime', () => {
       expect(clientRootModuleName.defaultValue()).not.toBeDefined();
     });
   });
+
+  describe('ONE_REFERRER_POLICY_OVERRIDE', () => {
+    const referrerPolicyOverride = getEnvVarConfig('ONE_REFERRER_POLICY_OVERRIDE');
+
+    it('default value', () => {
+      expect(referrerPolicyOverride.defaultValue()).toEqual('same-origin');
+    });
+
+    it('validates approved policy', () => {
+      expect(() => referrerPolicyOverride.validate('strict-origin')).not.toThrow();
+      expect(() => referrerPolicyOverride.validate('unsafe-url')).toThrow();
+    });
+  });
 });

__tests__/server/middleware/addSecurityHeaders.spec.js

@@ -36,4 +36,17 @@ describe('addSecurityHeaders', () => {
     );
     expect(next).toBeCalled();
   });
+
+  describe('Referrer-Policy', () => {
+    it('default can be overridden ', () => {
+      const req = { get: jest.fn(), headers: {} };
+      const res = { set: jest.fn((key, value) => value) };
+      process.env.ONE_REFERRER_POLICY_OVERRIDE = 'no-referrer';
+
+      addSecurityHeaders(req, res, jest.fn());
+      expect(res.set).toBeCalledWith('Referrer-Policy', 'no-referrer');
+
+      delete process.env.ONE_REFERRER_POLICY_OVERRIDE;
+    });
+  });
 });

docs/api/server/Environment-Variables.md

@@ -36,7 +36,7 @@ One App can be configured via Environment Variables:
   * [`HOLOCRON_SERVER_MAX_SIM_MODULES_FETCH`](#holocron_server_max_sim_modules_fetch)
   * [`ONE_ENABLE_POST_TO_MODULE_ROUTES`](#one_enable_post_to_module_routes)
   * [`ONE_MAP_POLLING_MAX`](#one_map_polling_max)
-  * [`ONE_MAP_POLLING_MIN`](#one_map_polling_min)
+  * [`ONE_REFERRER_POLICY_OVERRIDE`](#one_referrer_policy_override)
 
 **Alphabetical Contents**
 * [`HOLOCRON_MODULE_MAP_URL`](#holocron_module_map_url)
@@ -61,6 +61,7 @@ One App can be configured via Environment Variables:
 * [`ONE_ENABLE_POST_TO_MODULE_ROUTES`](#one_enable_post_to_module_routes)
 * [`ONE_MAP_POLLING_MAX`](#one_map_polling_max)
 * [`ONE_MAP_POLLING_MIN`](#one_map_polling_min)
+* [`ONE_REFERRER_POLICY_OVERRIDE`](#one_referrer_policy_override)
 
 > ⚠️ = Required
 
@@ -555,6 +556,30 @@ ONE_MAP_POLLING_MIN=Number
 ONE_MAP_POLLING_MIN=0
 ```
 
+## `ONE_REFERRER_POLICY_OVERRIDE`
+
+**Runs In**
+* ✅ Production
+* ✅ Development
+
+Overrides the `Referrer-Policy` header.
+
+Must be one of: `no-referrer`, `no-referrer-when-downgrade`, `same-origin` or `strict-origin`.
+
+**Shape**
+```bash
+ONE_REFERRER_POLICY_OVERRIDE=String
+```
+**Exampke**
+```bash
+ONE_REFERRER_POLICY_OVERRIDE=no-referrer
+```
+
+**Default Value**
+```bash
+ONE_REFERRER_POLICY_OVERRIDE=same-origin
+```
+
 **📘 More Information**
 * Useful NodeJS Env Variables: [Node CLI Docs](https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file)
 * [Development Tools Documentation](./Development-Tools.md)

src/server/config/env/runTime.js

@@ -176,6 +176,22 @@ const runTime = [
     validate: (value) => { if (!value) { throw new Error('The `ONE_CLIENT_ROOT_MODULE_NAME` environment variable must be defined.'); } },
     defaultValue: () => (process.env.NODE_ENV === 'development' ? argv.rootModuleName : undefined),
   },
+  {
+    name: 'ONE_REFERRER_POLICY_OVERRIDE',
+    defaultValue: () => 'same-origin',
+    validate: (value) => {
+      const approvedPolicies = [
+        'no-referrer',
+        'no-referrer-when-downgrade',
+        'same-origin',
+        'strict-origin',
+      ];
+
+      if (!approvedPolicies.includes(value)) {
+        throw new Error(`${value} in not an approved policy. Please use: ${approvedPolicies.join(',')}.`);
+      }
+    },
+  },
 ];
 
 runTime.forEach(preprocessEnvVar);

src/server/middleware/addSecurityHeaders.js

@@ -19,6 +19,6 @@ export default function addSecurityHeaders(req, res, next) {
   res.set('X-Content-Type-Options', 'nosniff');
   res.set('Strict-Transport-Security', 'max-age=15552000; includeSubDomains');
   res.set('X-XSS-Protection', '1; mode=block');
-  res.set('Referrer-Policy', 'same-origin');
+  res.set('Referrer-Policy', process.env.ONE_REFERRER_POLICY_OVERRIDE || 'same-origin');
   next();
 }