mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-18 02:56:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Set 'same-origin' as default SECURE_REFERRER_POLICY

Browse source 
Improve security by reducing referrer information leakage to third-party sites. This aligns with best practices and closes #29406. Adds tests to confirm new default behavior.
This commit is contained in:
utkarsh.arya@zomato.com 2025-11-15 22:58:16 +00:00
parent 7fa1a93c6c
commit 17345274fe
3 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
django/conf/global_settings.py
View file

@ -637,6 +637,6 @@ SECURE_HSTS_INCLUDE_SUBDOMAINS = False
SECURE_HSTS_PRELOAD = False
SECURE_HSTS_SECONDS = 0
SECURE_REDIRECT_EXEMPT = []
SECURE_REFERRER_POLICY = None
SECURE_REFERRER_POLICY = 'same-origin'
SECURE_SSL_HOST = None
SECURE_SSL_REDIRECT = False

3
tests/check_framework/test_security.py
View file

@ -516,6 +516,9 @@ class CheckReferrerPolicyTest(SimpleTestCase):
SECURE_REFERRER_POLICY=None,
)
def test_no_referrer_policy(self):
"""
Warn when SECURE_REFERRER_POLICY is explicitly set to None.
"""
self.assertEqual(self.func(None), [base.W022])
@override_settings(MIDDLEWARE=[], SECURE_REFERRER_POLICY=None)

8
tests/middleware/test_security.py
View file

@ -223,6 +223,14 @@ class SecurityMiddlewareTest(SimpleTestCase):
ret = self.process_request("get", "/some/url")
self.assertIsNone(ret)
def test_referrer_policy_default(self):
"""
With the default SECURE_REFERRER_POLICY value ('same-origin'), the
middleware adds "Referrer-Policy: same-origin" header to the response.
"""
# Test with default settings (same-origin)
self.assertEqual(self.process_response()['Referrer-Policy'], 'same-origin')
@override_settings(SECURE_REFERRER_POLICY=None)
def test_referrer_policy_off(self):
"""