Configure referrerPolicyo

MrChrisW · MrChrisW · commit 66ff72af9191 · 2020-09-30T21:24:56.000+10:00
Set the default referrer-policy header to strict-origin-when-cross-origin
diff --git a/middleware/index.js b/middleware/index.js
@@ -23,6 +23,7 @@ module.exports = function (app) {
   app.use(require('./loaderio-verification'))
   app.use(require('./cors'))
   app.use(require('./csp'))
+  app.use(require('./referrer-policy'))
   app.use(require('helmet')())
   app.use(require('./robots'))
   app.use(require('./cookie-parser'))
diff --git a/middleware/referrer-policy.js b/middleware/referrer-policy.js
@@ -0,0 +1,8 @@
+// This module defines the Referrer-Policy HEADER behaviour
+// https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns
+
+const { referrerPolicy } = require('helmet')
+
+module.exports = referrerPolicy({
+  policy: "strict-origin-when-cross-origin",
+})
