40 lines
951 B
Plaintext
40 lines
951 B
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
In Express.js application the code is sensitive if the https://www.npmjs.com/package/helmet[helmet] ``++referrerPolicy++`` middleware is disabled or used with ``++no-referrer-when-downgrade++`` or ``++unsafe-url++``:
|
|
|
|
----
|
|
const express = require('express');
|
|
const helmet = require('helmet');
|
|
|
|
app.use(
|
|
helmet.referrerPolicy({
|
|
policy: 'no-referrer-when-downgrade' // Sensitive: no-referrer-when-downgrade is used
|
|
})
|
|
);
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
In Express.js application a secure solution is to user the https://www.npmjs.com/package/helmet[helmet] referrer policy middleware set to ``++no-referrer++``:
|
|
|
|
----
|
|
const express = require('express');
|
|
const helmet = require('helmet');
|
|
|
|
let app = express();
|
|
|
|
app.use(
|
|
helmet.referrerPolicy({
|
|
policy: 'no-referrer' // Compliant
|
|
})
|
|
);
|
|
----
|
|
|
|
include::../see.adoc[]
|