From bugzilla-daemon@bugs.koha-community.org Mon Feb 24 16:02:44 2020
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 24717] New: Koha should set a referrer policy
Date: Mon, 24 Feb 2020 15:02:43 +0000
Message-ID: <bug-24717-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2936814496668279372=="

--===============2936814496668279372==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D24717

            Bug ID: 24717
           Summary: Koha should set a referrer policy
 Change sponsored?: ---
           Product: Koha
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5 - low
         Component: Architecture, internals, and plumbing
          Assignee: koha-bugs@lists.koha-community.org
          Reporter: gmcharlt@gmail.com
        QA Contact: testopia@bugs.koha-community.org

Koha should set a referrer policy [0] to restrict what is passed in the Refer=
er
header when external resources (e.g., cover images, added content of various
stripes, electronic resources, external images and CSS, etc.) are embedded or
navigated to.

If a referrer policy is not set, the default policy of
no-referrer-when-downgrade means that (say) the full referring URL, which can
include record IDs and catalog search strings, will be sent to outside
webservers providing external resources provided that loading the external
resource doesn't mean downgrading from HTTPS to HTTP.

Better values for the referrer policy include:

* strict-origin-when-cross-origin
* origin-when-cross-origin

Values that might break current Koha functionality that inspects the Referer
header include:

* no-referrer
* origin
* strict-origin

Values that might break legitimate inspection of the Referer header by servic=
es
that perform referring URL "authentication" include:

* no-referrer
* same-origin

A referrer policy can be set in various ways:

- Using a Referrer-Policy HTTP header configured at the Apache or NGINX level
- Using a meta tag:

<meta name=3D"referrer" content=3D"strict-origin-when-cross-origin">

- Using a referrerpolicy attribute in <a>, <area>, <img>, <iframe>, <script>,
or <link> tags
- Using a noreferrer link relation in <a>, <area>, or <link> elements.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

--=20
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============2936814496668279372==--


From bugzilla-daemon@bugs.koha-community.org Mon Feb 24 16:03:32 2020
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 24717] Koha should set a referrer policy
Date: Mon, 24 Feb 2020 15:03:31 +0000
Message-ID: <bug-24717-70-559UzldwCR@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-24717-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5782252256337571010=="

--===============5782252256337571010==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24717

Galen Charlton <gmcharlt@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |master
           Severity|enhancement                 |normal
           Priority|P5 - low                    |P3

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============5782252256337571010==--


From bugzilla-daemon@bugs.koha-community.org Sun Mar 15 23:00:26 2020
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 24717] Koha should set a referrer policy
Date: Sun, 15 Mar 2020 22:00:25 +0000
Message-ID: <bug-24717-70-KLmjaevVG9@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-24717-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2621762190185038098=="

--===============2621762190185038098==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24717

Katrin Fischer <katrin.fischer@bsz-bw.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |katrin.fischer@bsz-bw.de

--- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> ---
There is one feature I know in Koha that relies on the referrer:
RestrictedPage*
We use this page to add links to databases and other paid services that allow
for authentication by referrer. If we change the default in Koha, it would be
good if we could make an exception for links on that page.

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============2621762190185038098==--