From 863734d63396713750a0e77e204b861e35360990 Mon Sep 17 00:00:00 2001
From: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:10:02 +0100
Subject: [PATCH 1/4] feat(frontend): allow configuration of the referrerPolicy

Signed-off-by: vandr0iy<5510334+vandr0iy@users.noreply.github.com>
Signed-off-by: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
---
 .../http/readHelmetOptions.test.ts            |  9 ++++++
 .../rootHttpRouter/http/readHelmetOptions.ts  | 28 +++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
index 97daef359a..38cdf75396 100644
--- a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
+++ b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.test.ts
@@ -39,6 +39,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['no-referrer'],
+      },
     });
   });
 
@@ -50,6 +53,9 @@ describe('readHelmetOptions', () => {
         scriptSrcAttr: ['custom'],
         'object-src': ['asd'],
       },
+      referrer: {
+        policy: ['foo', 'bar'],
+      },
     });
     expect(readHelmetOptions(config)).toEqual({
       contentSecurityPolicy: {
@@ -71,6 +77,9 @@ describe('readHelmetOptions', () => {
       crossOriginOpenerPolicy: false,
       crossOriginResourcePolicy: false,
       originAgentCluster: false,
+      referrerPolicy: {
+        policy: ['foo', 'bar'],
+      },
     });
   });
 
diff --git a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
index fc1fc59bcb..040da63e5f 100644
--- a/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
+++ b/packages/backend-defaults/src/entrypoints/rootHttpRouter/http/readHelmetOptions.ts
@@ -46,6 +46,7 @@ export function readHelmetOptions(config?: Config): HelmetOptions {
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: false,
     originAgentCluster: false,
+    referrerPolicy: readReferrerPolicy(config),
   };
 }
 
@@ -113,3 +114,30 @@ export function applyCspDirectives(
 
   return result;
 }
+
+type ReferrerPolicy = Record<string, string[]> | undefined;
+
+/**
+ * Attempts to read the ReferrerPolicy from the backend configuration object.
+ *
+ * @example
+ * ```yaml
+ * backend:
+ *   referrer:
+ *     policy: ["strict-origin-when-cross-origin"]
+ * ```
+ */
+function readReferrerPolicy(config?: Config): ReferrerPolicy {
+  const cc = config?.getOptionalConfig('referrer');
+  const result: Record<string, string[]> = {};
+
+  if (!cc) {
+    result.policy = ['no-referrer'];
+  } else {
+    for (const key of cc.keys()) {
+      result[key] = cc.getStringArray(key);
+    }
+  }
+
+  return result;
+}

From a98c71a435851a35eaba3c8e768cd3d080e35e4e Mon Sep 17 00:00:00 2001
From: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
Date: Thu, 4 Dec 2025 11:50:45 +0100
Subject: [PATCH 2/4] feat(frontend): adding the referrer options to
 config.d.ts

Signed-off-by: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
---
 packages/backend-defaults/config.d.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/backend-defaults/config.d.ts b/packages/backend-defaults/config.d.ts
index f0632a37bb..6131169d6b 100644
--- a/packages/backend-defaults/config.d.ts
+++ b/packages/backend-defaults/config.d.ts
@@ -993,6 +993,13 @@ export interface Config {
      */
     csp?: { [policyId: string]: string[] | false };
 
+    /**
+     * Referrer Policy options
+     */
+    referrer?: {
+      policy: string[];
+    };
+
     /**
      * Options for the health check service and endpoint.
      */

From f96edfffa6a5539d25c3ace897faf80658d7abc4 Mon Sep 17 00:00:00 2001
From: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
Date: Thu, 4 Dec 2025 11:53:32 +0100
Subject: [PATCH 3/4] chore: adding changeset

Signed-off-by: vandr0iy <5510334+vandr0iy@users.noreply.github.com>
---
 .changeset/early-doors-visit.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/early-doors-visit.md

diff --git a/.changeset/early-doors-visit.md b/.changeset/early-doors-visit.md
new file mode 100644
index 0000000000..828c8f26eb
--- /dev/null
+++ b/.changeset/early-doors-visit.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+allow configuration of the referrerPolicy

From 622c29c9009b1449eac255ea2c8921afc0d8375e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Tue, 9 Dec 2025 12:18:11 +0100
Subject: [PATCH 4/4] Update .changeset/early-doors-visit.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 .changeset/early-doors-visit.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/early-doors-visit.md b/.changeset/early-doors-visit.md
index 828c8f26eb..41cd9e92b8 100644
--- a/.changeset/early-doors-visit.md
+++ b/.changeset/early-doors-visit.md
@@ -2,4 +2,4 @@
 '@backstage/backend-defaults': patch
 ---
 
-allow configuration of the referrerPolicy
+Allow configuration of the `referrerPolicy`