Merge pull request #31678 from vandr0iy/vandr0iy/configurable-referrer-policy

feat(frontend): allow configuration of the referrerPolicy

.changeset/early-doors-visit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Allow configuration of the `referrerPolicy`

packages/backend-defaults/config.d.ts

@@ -993,6 +993,13 @@ export interface Config {
      */
     csp?: { [policyId: string]: string[] | false };
 
+    /**
+     * Referrer Policy options
+     */
+    referrer?: {
+      policy: string[];
+    };
+
     /**
      * Options for the health check service and endpoint.
      */

packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts

@@ -39,6 +39,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['no-referrer'],
+      },
     });
   });
 
@@ -50,6 +53,9 @@ describe('readHelmetOptions', () => {
         scriptSrcAttr: ['custom'],
         'object-src': ['asd'],
       },
+      referrer: {
+        policy: ['foo', 'bar'],
+      },
     });
     expect(readHelmetOptions(config)).toEqual({
       contentSecurityPolicy: {
@@ -71,6 +77,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['foo', 'bar'],
+      },
     });
   });
 

packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts

@@ -46,6 +46,7 @@ export function readHelmetOptions(config?: Config): HelmetOptions {
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: false,
     originAgentCluster: false,
+    referrerPolicy: readReferrerPolicy(config),
   };
 }
 
@@ -113,3 +114,30 @@ export function applyCspDirectives(
 
   return result;
 }
+
+type ReferrerPolicy = Record<string, string[]> | undefined;
+
+/**
+ * Attempts to read the ReferrerPolicy from the backend configuration object.
+ *
+ * @example
+ * ```yaml
+ * backend:
+ *   referrer:
+ *     policy: ["strict-origin-when-cross-origin"]
+ * ```
+ */
+function readReferrerPolicy(config?: Config): ReferrerPolicy {
+  const cc = config?.getOptionalConfig('referrer');
+  const result: Record<string, string[]> = {};
+
+  if (!cc) {
+    result.policy = ['no-referrer'];
+  } else {
+    for (const key of cc.keys()) {
+      result[key] = cc.getStringArray(key);
+    }
+  }
+
+  return result;
+}