https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24717 Bug ID: 24717 Summary: Koha should set a referrer policy Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: gmcharlt@gmail.com QA Contact: testopia@bugs.koha-community.org Koha should set a referrer policy [0] to restrict what is passed in the Referer header when external resources (e.g., cover images, added content of various stripes, electronic resources, external images and CSS, etc.) are embedded or navigated to. If a referrer policy is not set, the default policy of no-referrer-when-downgrade means that (say) the full referring URL, which can include record IDs and catalog search strings, will be sent to outside webservers providing external resources provided that loading the external resource doesn't mean downgrading from HTTPS to HTTP. Better values for the referrer policy include: * strict-origin-when-cross-origin * origin-when-cross-origin Values that might break current Koha functionality that inspects the Referer header include: * no-referrer * origin * strict-origin Values that might break legitimate inspection of the Referer header by services that perform referring URL "authentication" include: * no-referrer * same-origin A referrer policy can be set in various ways: - Using a Referrer-Policy HTTP header configured at the Apache or NGINX level - Using a meta tag: <meta name="referrer" content="strict-origin-when-cross-origin"> - Using a referrerpolicy attribute in <a>, <area>, <img>, <iframe>, <script>, or <link> tags - Using a noreferrer link relation in <a>, <area>, or <link> elements. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.