feat(frontend): allow configuration of the referrerPolicy

Signed-off-by: vandr0iy<5510334+vandr0iy@users.noreply.github.com>
Signed-off-by: vandr0iy <5510334+vandr0iy@users.noreply.github.com>

packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts

@@ -39,6 +39,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['no-referrer'],
+      },
     });
   });
 
@@ -50,6 +53,9 @@ describe('readHelmetOptions', () => {
         scriptSrcAttr: ['custom'],
         'object-src': ['asd'],
       },
+      referrer: {
+        policy: ['foo', 'bar'],
+      },
     });
     expect(readHelmetOptions(config)).toEqual({
       contentSecurityPolicy: {
@@ -71,6 +77,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['foo', 'bar'],
+      },
     });
   });
 

packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts

@@ -46,6 +46,7 @@ export function readHelmetOptions(config?: Config): HelmetOptions {
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: false,
     originAgentCluster: false,
+    referrerPolicy: readReferrerPolicy(config),
   };
 }
 
@@ -113,3 +114,30 @@ export function applyCspDirectives(
 
   return result;
 }
+
+type ReferrerPolicy = Record<string, string[]> | undefined;
+
+/**
+ * Attempts to read the ReferrerPolicy from the backend configuration object.
+ *
+ * @example
+ * ```yaml
+ * backend:
+ *   referrer:
+ *     policy: ["strict-origin-when-cross-origin"]
+ * ```
+ */
+function readReferrerPolicy(config?: Config): ReferrerPolicy {
+  const cc = config?.getOptionalConfig('referrer');
+  const result: Record<string, string[]> = {};
+
+  if (!cc) {
+    result.policy = ['no-referrer'];
+  } else {
+    for (const key of cc.keys()) {
+      result[key] = cc.getStringArray(key);
+    }
+  }
+
+  return result;
+}