DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
JavaScript

JavaScript

Made by DeepSource
Use Analyzer

Detected Unsafe referrer policy JS-S1011

Security
Critical
 a05 sans top 25 owasp top 10 cwe-937

The Referrer-policy HTTP header controls the amount of referrer information included in requests. Incorrectly configuring this header can lead to exposure of private data on the referrer's side.

The possible values for this directive can be found here on MDN. The unsafe-url directive sends the origin, path and query string with every request object. This may lead to leakage of private information.

Bad Practice

import helmet from 'helmet'
import express from 'express'

const app = express()
// One of: unsafe-url, no-referrer-when-downgrade 
app.use(helmet.referrerPolicy({ policy: 'unsafe-url' })

Recommended

import helmet from 'helmet'
import express from 'express'

const app = express()
// One of: no-referrer, origin, same-origin, strict-origin, origin-when-cross-origin
app.use(helmet.referrerPolicy({ policy: 'no-referrer' })

References