Tighten Referrer-Policy to https only

OpenConext · Nov 22, 2023 · 6f75e7b · 6f75e7b
1 parent f6978b7
commit 6f75e7b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/client/docker/appconf.conf b/client/docker/appconf.conf
@@ -59,5 +59,5 @@ Header set Expires "Sun, 8 Jun 1986 08:06:00 GMT"
 </FilesMatch>
 
 Header always set X-Frame-Options "DENY"
-Header always set Referrer-Policy "origin-when-cross-origin"
+Header always set Referrer-Policy "strict-origin-when-cross-origin"
 Header always set X-Content-Type-Options "nosniff"
diff --git a/welcome/docker/appconf.conf b/welcome/docker/appconf.conf
@@ -52,5 +52,5 @@ Header set Expires "Sun, 8 Jun 1986 08:06:00 GMT"
 </FilesMatch>
 
 Header always set X-Frame-Options "DENY"
-Header always set Referrer-Policy "origin-when-cross-origin"
+Header always set Referrer-Policy "strict-origin-when-cross-origin"
 Header always set X-Content-Type-Options "nosniff"