diff options
| author | Roeland Jago Douma <roeland@famdouma.nl> | 2018-06-02 21:29:36 +0200 |
|---|---|---|
| committer | Roeland Jago Douma <roeland@famdouma.nl> | 2018-06-04 09:21:35 +0200 |
| commit | 4b70c9f89d10a3bcf96d8fa349c8fa80baa4d3de (patch) | |
| tree | 1d1e01d8c790f5df33016ab70c9fa338c1a6bd36 /core/js/setupchecks.js | |
| parent | 36d74047f7ead966438ae7958ca7d7f816860515 (diff) | |
| download | nextcloud-server-4b70c9f89d10a3bcf96d8fa349c8fa80baa4d3de.tar.gz nextcloud-server-4b70c9f89d10a3bcf96d8fa349c8fa80baa4d3de.zip | |
Add referrer policy setup check
Fixes #9122
Based on https://www.w3.org/TR/referrer-policy/ and
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Setting a sane Referrer-Policy will tell the browser if/when to send
referrer headers when accessing a link from Nextcloud. When configured
properly this results in less tracking and less leaking of (possibly)
sensitive urls
* Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'core/js/setupchecks.js')
| -rw-r--r-- | core/js/setupchecks.js | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js index af769dd9b7c..a2a75086935 100644 --- a/core/js/setupchecks.js +++ b/core/js/setupchecks.js @@ -283,6 +283,25 @@ }); } } + + if (!xhr.getResponseHeader('Referrer-Policy') || + (xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'no-referrer' && + xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'no-referrer-when-downgrade' && + xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'strict-origin' && + xhr.getResponseHeader('Referrer-Policy').toLowerCase() !== 'strict-origin-when-cross-origin')) { + messages.push({ + msg: t('core', 'The "{header}" HTTP header is not set to "{val1}", "{val2}", "{val3}" or "{val4}". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" href="{link}">W3C Recommendation</a>.', + { + header: 'Referrer-Policy', + val1: 'no-referrer', + val2: 'no-referrer-when-downgrade', + val3: 'strict-origin', + val4: 'strict-origin-when-cross-origin', + link: 'https://www.w3.org/TR/referrer-policy/' + }), + type: OC.SetupChecks.MESSAGE_TYPE_INFO + }); + } } else { messages.push({ msg: t('core', 'Error occurred while checking server setup'), |