fix(gatsby-plugin-netlify): Add Referrer-Policy to security headers

[browniebroke]

Description

Add 'Referrer-Policy: same-origin' to SECURITY_HEADERS.

This is one of the headers checked by securityheaders.com and currently it's not included by Gatsby by default. I was adding it to a few of my projects, but I realised it could probably be added upstream, so here it is.

Looking around, it seems that 'same-origin' is a good default, but I don't feel strongly about it. Would this be welcome?

Related Issues

[sidharthachatterjee]

This is a welcome addition and same-origin is a good default to have! Thank you so much @browniebroke and congratulations on your first contribution! 🥇

[gatsbot]

Holy buckets, @browniebroke — we just merged your PR to Gatsby! 💪💜

Gatsby is built by awesome people like you. Let us say “thanks” in two ways:

1. We’d like to send you some Gatsby swag. As a token of our appreciation, you can go to the Gatsby Swag Store and log in with your GitHub account to get a coupon code good for one free piece of swag. (Currently we’ve got a couple t-shirts available, plus some socks that are really razzing our berries right now.)
2. We just invited you to join the Gatsby organization on GitHub. This will add you to our team of maintainers. Accept the invite by visiting https://github.com/orgs/gatsbyjs/invitation. By joining the team, you’ll be able to label issues, review pull requests, and merge approved pull requests.

If there’s anything we can do to help, please don’t hesitate to reach out to us: tweet at @gatsbyjs and we’ll come a-runnin’.

Thanks again!

[sidharthachatterjee]

Published in [email protected]

[rmehner]

This is actually a breaking change for us and it took me a while to find this.

We use a map image provider who doesn't use an API key but the referrer to regulate access. This stopped working for us, as it's not same-origin and we'd need no-referrer-when-downgrade at minimum.

It's easy to fix by adjusting the gatsby-config:

{
  resolve: 'gatsby-plugin-netlify',
  options: {
    headers: {
      '/*': [`Referrer-Policy: no-referrer-when-downgrade`],
    },
  },
},

Should have checked the release notes more thoroughly before updating the package :)

[rmehner]

Turns out my fix is wrong, as it will create the header as:

referrer-policy: no-referrer-when-downgrade, same-origin

I'll change it to this:

{
      resolve: 'gatsby-plugin-netlify',
      options: {
        mergeSecurityHeaders: false,
        headers: {
          '/*': [
            `X-Frame-Options: DENY`,
            `X-XSS-Protection: 1; mode=block`,
            `X-Content-Type-Options: nosniff`,
            `Referrer-Policy: no-referrer-when-downgrade`,
          ],
        },
      },
    },```

[jlev]

This broke API access for me as well that relied on referer headers. Not a good default, would suggest origin-when-cross-origin instead