helmet: Allow referrerPolicy.policy to be an array of strings (#44235)

* Setting a referrer policy as an array of strings is permitted. This will result in a comma-separated list of policies, where the last policy understood by the browser would be the one applied. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy, "Specifying a fallback policy".

* Added a test for when referrerPolicy.policy is an array of strings.
This commit is contained in:
TDurrr1 2020-04-26 12:20:57 -05:00 committed by GitHub
parent 5acdc8f0a7
commit 02f28e78a6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 2 deletions

View File

@ -232,7 +232,8 @@ function noSniffTest() {
* @summary Test for {@see helmet#referrerPolicy} function.
*/
function referrerPolicyTest() {
app.use(helmet.referrerPolicy({ policy: 'same-origin' }))
app.use(helmet.referrerPolicy({ policy: 'same-origin' }));
app.use(helmet.referrerPolicy({ policy: ['no-referrer', 'origin', 'strict-origin', 'strict-origin-when-cross-origin'] }));
}
/**

View File

@ -168,7 +168,7 @@ declare namespace helmet {
}
export interface IHelmetReferrerPolicyConfiguration {
policy?: string;
policy?: string | string[];
}
export interface IHelmetXssFilterConfiguration {