Skip to main content

A vulnerability assessment reported that the Referrer-Policy header is missing. Do I need to address this?

The required action depends on whether the reported URL is a Kuroco API URL or the URL of a page published on KurocoFront.

Reported URLExample URLAction
Kuroco API URL (a URL that contains /rcms-api/)https://sitekey.g.kuroco.app/rcms-api/1/topicsNo action is required.
URL of a page published on KurocoFronthttps://sitekey.g.kuroco-front.app/Configure it with headers in kuroco_front.json as needed.

You can also check the domain of the URL. A domain ending in kuroco.app is an API URL, and a domain ending in kuroco-front.app is a KurocoFront URL.
If you use a custom domain, check whether the domain is assigned to the API or to the frontend.

What is the Referrer-Policy header?​

The Referrer-Policy header is a response header that specifies what the browser sends in the Referer header when it navigates from the displayed page to a link or loads resources such as images and scripts. It mainly takes effect when added to HTML responses that the browser displays as pages.

API responses​

You do not need to add the Referrer-Policy header to Kuroco API responses.

API responses are mainly data such as JSON (Content-Type: application/json) that the browser does not display as pages. Because no navigation to links or loading of resources is performed from an API response, adding the Referrer-Policy header has no Referer header to control.

Pages published on KurocoFront​

KurocoFront does not add the Referrer-Policy header by default. To add it, configure it with headers in kuroco_front.json.

"headers": [
    {
      "source": ".*",
      "headers": {
        "Referrer-Policy": "strict-origin-when-cross-origin"
      }
    }
],

Specify the Referrer-Policy value according to your site's requirements. For how to write headers and the rules for matching target URIs, see What is kuroco_front.json?.

note

If you publish your frontend on a service other than KurocoFront, configure the response headers on that service.

Support

If you have any other questions, please contact us or check out Our Slack Community.

Contact form
Join Kuroco Slack community