From 863734d63396713750a0e77e204b861e35360990 Mon Sep 17 00:00:00 2001
From: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:10:02 +0100
Subject: [PATCH] feat(frontend): allow configuration of the referrerPolicy

Signed-off-by: vandr0iy<5510334+vandr0iy@users.noreply.github.com>
Signed-off-by: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
---
 .../http/readHelmetOptions.test.ts            |  9 ++++++
 .../rootHttpRouter/http/readHelmetOptions.ts  | 28 +++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
index 97daef359a..38cdf75396 100644
--- a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
+++ b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
@@ -39,6 +39,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['no-referrer'],
+      },
     });
   });
 
@@ -50,6 +53,9 @@ describe('readHelmetOptions', () => {
         scriptSrcAttr: ['custom'],
         'object-src': ['asd'],
       },
+      referrer: {
+        policy: ['foo', 'bar'],
+      },
     });
     expect(readHelmetOptions(config)).toEqual({
       contentSecurityPolicy: {
@@ -71,6 +77,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['foo', 'bar'],
+      },
     });
   });
 
diff --git a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
index fc1fc59bcb..040da63e5f 100644
--- a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
+++ b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
@@ -46,6 +46,7 @@ export function readHelmetOptions(config?: Config): HelmetOptions {
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: false,
     originAgentCluster: false,
+    referrerPolicy: readReferrerPolicy(config),
   };
 }
 
@@ -113,3 +114,30 @@ export function applyCspDirectives(
 
   return result;
 }
+
+type ReferrerPolicy = Record<string, string[]> | undefined;
+
+/**
+ * Attempts to read the ReferrerPolicy from the backend configuration object.
+ *
+ * @example
+ * ```yaml
+ * backend:
+ *   referrer:
+ *     policy: ["strict-origin-when-cross-origin"]
+ * ```
+ */
+function readReferrerPolicy(config?: Config): ReferrerPolicy {
+  const cc = config?.getOptionalConfig('referrer');
+  const result: Record<string, string[]> = {};
+
+  if (!cc) {
+    result.policy = ['no-referrer'];
+  } else {
+    for (const key of cc.keys()) {
+      result[key] = cc.getStringArray(key);
+    }
+  }
+
+  return result;
+}