github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Update referrer policy default to a stricter value (#177559)

Browse source 
### Summary
Update the default value of
`server.securityResponseHeaders.referrerPolicy` to a stricter value:
`strict-origin-when-cross-origin`
This commit is contained in:
Sid 2024-03-07 10:49:55 +01:00 • committed by GitHub
parent af5f4a0558
commit 88ddcc43e1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/setup/settings.asciidoc
View file

@ -405,7 +405,7 @@ disable, set to `null`. *Default:* `"nosniff"`
Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy[`Referrer-Policy`] header is used in all
responses to the client from the {kib} server, and specifies what value is used. Allowed values are `no-referrer`,
`no-referrer-when-downgrade`, `origin`, `origin-when-cross-origin`, `same-origin`, `strict-origin`, `strict-origin-when-cross-origin`,
`unsafe-url`, or `null`. To disable, set to `null`. *Default:* `"no-referrer-when-downgrade"`
`unsafe-url`, or `null`. To disable, set to `null`. *Default:* `"strict-origin-when-cross-origin"`
[[server-securityResponseHeaders-permissionsPolicy]] `server.securityResponseHeaders.permissionsPolicy`::
experimental[] Controls whether the https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy[`Permissions-Policy`] header

2
packages/core/http/core-http-server-internal/src/__snapshots__/http_config.test.ts.snap generated
View file

@ -84,7 +84,7 @@ Object {
"crossOriginOpenerPolicy": "same-origin",
"disableEmbedding": false,
"permissionsPolicy": "camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()",
"referrerPolicy": "no-referrer-when-downgrade",
"referrerPolicy": "strict-origin-when-cross-origin",
"strictTransportSecurity": null,
"xContentTypeOptions": "nosniff",
},

2
packages/core/http/core-http-server-internal/src/security_response_headers_config.test.ts
View file

@ -20,7 +20,7 @@ describe('parseRawSecurityResponseHeadersConfig', () => {
Object {
"Cross-Origin-Opener-Policy": "same-origin",
"Permissions-Policy": "camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()",
"Referrer-Policy": "no-referrer-when-downgrade",
"Referrer-Policy": "strict-origin-when-cross-origin",
"X-Content-Type-Options": "nosniff",
}
`);

2
packages/core/http/core-http-server-internal/src/security_response_headers_config.ts
View file

@ -30,7 +30,7 @@ export const securityResponseHeadersSchema = schema.object({
schema.literal('unsafe-url'),
schema.literal(null),
],
{ defaultValue: 'no-referrer-when-downgrade' }
{ defaultValue: 'strict-origin-when-cross-origin' }
),
permissionsPolicy: schema.oneOf([schema.string(), schema.literal(null)], {
// See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy

2
packages/core/usage-data/core-usage-data-server-internal/src/core_usage_data_service.test.ts
View file

@ -311,7 +311,7 @@ describe('CoreUsageDataService', () => {
"crossOriginOpenerPolicy": "same-origin",
"disableEmbedding": false,
"permissionsPolicyConfigured": true,
"referrerPolicy": "no-referrer-when-downgrade",
"referrerPolicy": "strict-origin-when-cross-origin",
"strictTransportSecurity": "NULL",
"xContentTypeOptions": "nosniff",
},

2
x-pack/test_serverless/api_integration/test_suites/common/platform_security/response_headers.ts
View file

@ -18,7 +18,7 @@ export default function ({ getService }: FtrProviderContext) {
const defaultPermissionsPolicy =
'camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()';
const defaultStrictTransportSecurity = 'max-age=31536000; includeSubDomains';
const defaultReferrerPolicy = 'no-referrer-when-downgrade';
const defaultReferrerPolicy = 'strict-origin-when-cross-origin';
const defaultXContentTypeOptions = 'nosniff';
const defaultXFrameOptions = 'SAMEORIGIN';