Bug 24717 - Koha should set a referrer policy
Summary: Koha should set a referrer policy
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P3 normal (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-24 15:02 UTC by Galen Charlton
Modified: 2020-03-15 22:00 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2020-02-24 15:02:43 UTC
Koha should set a referrer policy [0] to restrict what is passed in the Referer header when external resources (e.g., cover images, added content of various stripes, electronic resources, external images and CSS, etc.) are embedded or navigated to.

If a referrer policy is not set, the default policy of no-referrer-when-downgrade means that (say) the full referring URL, which can include record IDs and catalog search strings, will be sent to outside webservers providing external resources provided that loading the external resource doesn't mean downgrading from HTTPS to HTTP.

Better values for the referrer policy include:

* strict-origin-when-cross-origin
* origin-when-cross-origin

Values that might break current Koha functionality that inspects the Referer header include:

* no-referrer
* origin
* strict-origin

Values that might break legitimate inspection of the Referer header by services that perform referring URL "authentication" include:

* no-referrer
* same-origin

A referrer policy can be set in various ways:

- Using a Referrer-Policy HTTP header configured at the Apache or NGINX level
- Using a meta tag:

<meta name="referrer" content="strict-origin-when-cross-origin">

- Using a referrerpolicy attribute in <a>, <area>, <img>, <iframe>, <script>, or <link> tags
- Using a noreferrer link relation in <a>, <area>, or <link> elements.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Comment 1 Katrin Fischer 2020-03-15 22:00:25 UTC
There is one feature I know in Koha that relies on the referrer: RestrictedPage*
We use this page to add links to databases and other paid services that allow for authentication by referrer. If we change the default in Koha, it would be good if we could make an exception for links on that page.