Add Referrer-Policy HTTP Header, #281

requirements.d/all.txt

@@ -3,6 +3,7 @@ dnspython
 netaddr
 django~=1.11.0
 django-bootstrap-form
+django-referrer-policy
 django-registration-redux
 django-extensions
 social-auth-app-django

setup.py

@@ -33,6 +33,7 @@ setup(
         'netaddr',
         'django>=1.11.0',
         'django-bootstrap-form',
+        'django-referrer-policy',
         'django-registration-redux',
         'django-extensions',
         'social-auth-app-django',

src/nsupdate/settings/base.py

@@ -167,6 +167,7 @@ MIDDLEWARE = (
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.locale.LocaleMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
+    'django_referrer_policy.middleware.ReferrerPolicyMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'social_django.middleware.SocialAuthExceptionMiddleware',
@@ -275,6 +276,7 @@ LOGOUT_REDIRECT_URL = '/'
 X_FRAME_OPTIONS = 'DENY'  # for clickjacking middleware
 SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
+REFERRER_POLICY = 'same-origin'
 
 CSRF_FAILURE_VIEW = 'nsupdate.main.views.csrf_failure_view'