Need

Implementation of secure and properly configured HTTP headers, specifically the Referrer-Policy header.

Context

• Usage of TypeScript for type-checking and compiling JavaScript code
• Usage of Express for building web applications and handling HTTP requests

Description

Non compliant code

        import express from 'express';

const app = express();

app.get('/', (req, res) => {
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The vulnerability in this code is that it does not set the Referrer-Policy HTTP header in the server responses. This header is responsible for controlling how much information about the referring URL is included in the request headers when a user navigates from one page to another.

Without setting the Referrer-Policy header, the browser will default to using the no-referrer-when-downgrade policy, which means that the full URL of the referring page will be included in the request headers when navigating to a different domain. This can potentially leak sensitive information about the website's domain and path to external services.

To fix this vulnerability, the code should include the appropriate Referrer-Policy header in the server responses. This can be done by adding the following code:

                app.use((req, res, next) => {
  res.setHeader('Referrer-Policy', 'no-referrer');
  next();
});

            

Steps

• Install the `helmet` package by running `npm install helmet`.
• Import the `helmet` package in your code by adding `import helmet from 'helmet';`.
• Add the `helmet` middleware to your Express app by adding `app.use(helmet());` before defining your routes.
• Set the `Referrer-Policy` header to one of the recommended values (`no-referrer`, `same-origin`, `strict-origin`, or `strict-origin-when-cross-origin`) by adding `app.use(helmet.referrerPolicy({ policy: 'no-referrer' }));` after adding the `helmet` middleware.
• Restart your server and verify that the `Referrer-Policy` header is now set correctly.

Compliant code

        import express from 'express';
import helmet from 'helmet';

const app = express();

app.use(helmet());
app.use(helmet.referrerPolicy({ policy: 'no-referrer' }));

app.get('/', (req, res) => {
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});
        
        

The fixed code addresses the vulnerability by setting the Referrer-Policy header to 'no-referrer' using the Helmet middleware in an Express.js application.

First, the code imports the necessary modules, 'express' and 'helmet'. Express is a popular web application framework for Node.js, while Helmet is a middleware package that helps secure Express applications by setting various HTTP headers.

Next, an instance of the Express application is created using the 'express()' function and assigned to the 'app' variable.

The code then applies the Helmet middleware to the application using the 'app.use(helmet())' statement. This enables various security-related headers provided by Helmet.

To specifically address the Referrer-Policy vulnerability, the code uses the app.use(helmet.referrerPolicy({ policy: 'no-referrer' })) statement. This sets the Referrer-Policy header to 'no-referrer', which means that the browser will not send the referrer information when navigating to external websites.

After setting up the middleware, the code defines a simple route handler for the root path ('/') that sends the response 'Hello World!' when accessed.

Finally, the application listens on port 3000 using the 'app.listen(3000)' statement and logs a message to indicate that the server is running.

By setting the Referrer-Policy header to 'no-referrer' using the Helmet middleware, the fixed code ensures that the server response includes the necessary header to prevent leaking the website domain and path to external services.

References

• 071. Insecure or unset HTTP headers - Referrer-Policy