Support Referrer-Policy http response

Author: MarcialRosales

deps/rabbitmq_management/priv/schema/rabbitmq_management.schema

@@ -461,6 +461,20 @@ fun(Conf) ->
 end}.
 
 
+%% Referrer-Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy)
+
+{mapping, "management.headers.referrer_policy", "rabbitmq_management.headers.referrer_policy", [
+    {datatype, string}
+]}.
+
+{translation, "rabbitmq_management.headers.referrer_policy",
+fun(Conf) ->
+    case cuttlefish:conf_get("management.headers.referrer_policy", Conf, undefined) of
+        undefined -> cuttlefish:unset();
+        Value     -> Value
+    end
+end}.
+
 
 {mapping, "management.disable_basic_auth", "rabbitmq_management.disable_basic_auth",
     [{datatype, boolean}]}.

deps/rabbitmq_management/src/rabbit_mgmt_headers.erl

@@ -15,6 +15,7 @@
 -define(X_CONTENT_TYPE_OPTIONS_HEADER, <<"x-content-type-options">>).
 -define(X_FRAME_OPTIONS_HEADER, <<"x-frame-options">>).
 -define(X_XSS_PROTECTION_HEADER, <<"x-xss-protection">>).
+-define(REFERRER_POLICY_HEADER, <<"referrer-policy">>).
 
 %%
 %% API
@@ -38,6 +39,9 @@ set_xss_protection_header(ReqData, _Module) ->
 set_frame_options_header(ReqData, _Module) ->
     maybe_set_known_configured_header(ReqData, frame_options, ?X_FRAME_OPTIONS_HEADER).
 
+set_referrer_policy_header(ReqData, _Module) ->
+    maybe_set_known_configured_header(ReqData, referrer_policy, ?REFERRER_POLICY_HEADER).
+
 maybe_set_known_configured_header(ReqData, AppEnvKey, HeaderName) ->
     case application:get_env(rabbitmq_management, headers) of
         undefined      -> ReqData;
@@ -61,7 +65,8 @@ set_common_permission_headers(ReqData0, EndpointModule) ->
                 fun set_cors_headers/2,
                 fun set_content_type_options_header/2,
                 fun set_xss_protection_header/2,
-                fun set_frame_options_header/2]).
+                fun set_frame_options_header/2,
+                fun set_referrer_policy_header/2]).
 
 set_etag_based_cache_headers(ReqData0, _Module) ->
     cowboy_req:set_resp_header(<<"cache-control">>, <<"public, max-age=0, must-revalidate">>, ReqData0).

deps/rabbitmq_management/test/config_schema_SUITE_data/rabbitmq_management.snippets

@@ -533,6 +533,37 @@
   ], [rabbitmq_management]
  },
 
+ %%
+ %% Referrer-Policy
+ %%
+
+ {headers_referrer_policy_case1,
+  "management.headers.referrer_policy = no-referrer",
+  [
+   {rabbitmq_management, [
+                          {headers, [
+                            {referrer_policy, "no-referrer"}
+                          ]}
+                         ]}
+  ], [rabbitmq_management]
+ },
+
+ {csp_and_hsts_and_referrer_policy_combined,
+  "management.csp.policy = default-src 'self' *.mailsite.com; img-src *
+   management.hsts.policy = max-age=31536000; includeSubDomains
+   management.headers.referrer_policy = no-referrer",
+  [
+   {rabbitmq_management, [
+                          {content_security_policy, "default-src 'self' *.mailsite.com; img-src *"},
+                          {strict_transport_security, "max-age=31536000; includeSubDomains"},
+
+                          {headers, [
+                            {referrer_policy, "no-referrer"}
+                          ]}
+                         ]}
+  ], [rabbitmq_management]
+ },
+
  %%
  %% Restrictions
  %%

deps/rabbitmq_management/test/rabbit_mgmt_http_SUITE.erl

@@ -217,6 +217,7 @@ all_tests() -> [
     login_encrypted_test,
     login_session_cookie_test,
     csp_headers_test,
+    referrer_policy_headers_test,
     auth_attempts_test,
     user_limits_list_test,
     user_limit_set_test,
@@ -4334,6 +4335,19 @@ csp_headers_test(Config) ->
     {ok, {_, HdGetCsp1, _}} = req(Config, get_static, "/index.html", Headers),
     ?assert(lists:keymember("content-security-policy", 1, HdGetCsp1)).
 
+referrer_policy_headers_test(Config) ->
+    AuthHeader = auth_header("guest", "guest"),
+    rpc(Config, application, set_env,
+        [rabbitmq_management, headers, [{referrer_policy, "no-referrer"}]]),
+    {ok, {_, Hd0, _}} = req(Config, get, "/whoami", [AuthHeader]),
+    ?assertEqual("no-referrer",
+                 proplists:get_value("referrer-policy", Hd0)),
+    rpc(Config, application, set_env,
+        [rabbitmq_management, headers, []]),
+    {ok, {_, Hd1, _}} = req(Config, get, "/whoami", [AuthHeader]),
+    ?assertEqual(undefined,
+                 proplists:get_value("referrer-policy", Hd1)).
+
 disable_basic_auth_test(Config) ->
     rpc(Config, application, set_env, [rabbitmq_management, disable_basic_auth, true]),
     http_get(Config, "/overview", ?NOT_AUTHORISED),