Harden Headers

[tankerkiller125]

**Partial Fix #353 **

Changes proposed in this pull request:

• Adds the Referer Policy header (with config option)
• Adds Xss Protection header
• Adds Content Type header

Reviewers should focus on:

• Does the config option for the Referer policy make sense? Or should we use some sort of constants?
• We probably need to add some test for this but I'm unsure

Confirmed

• Backend changes: tests are green (run composer test).

Additional PRs Required

• Move Powered By Header to headers config #2777

[askvortsov1]

This definitely should have tests. We could add a header subfolder to the integration test directory?

Or alternatively, construct a fake middleware pipe with a fake handler, and use unit tests.

[askvortsov1]

Stylistic comment. Also would be good to see some basic integration tests (ping /, check for headers)

[tankerkiller125]

This definitely should have tests. We could add a header subfolder to the integration test directory?

I'm thinking maybe a middleware subfolder, that way in the future we can test other middleware?

[tankerkiller125]

As a note I'm not sure why the test are failing, it seems to be that it's hitting rate limits or something? Everything is working locally 100% just fine and all test are passing on my machine.

[davwheat]

All looks good to me from a headers point of view!

[askvortsov1]

As a note I'm not sure why the test are failing, it seems to be that it's hitting rate limits or something?

FIgured it out. The setting method of test case runs BEFORE transactions are started, so those changes don't go into transactions. Opened a PR: flarum/testing#11

[askvortsov1]

This should not be part of this PR.

Unfortunately it probably should, as tests break without it. There's a bunch of stuff that shouldn't though. From chat:

I think it might be easiest here to:

• start a new branch from master
• cherry-pick over relevant commits
• run tests
• force update current branch to this new branch

[tankerkiller125]

I've re-based correctly this time, but it appears that test unrelated to this PR are failing again. I'm not entirely sure what's going on here. Maybe @askvortsov1 can take a look when he gets a chance?

[askvortsov1]

Fixed up tests, moved those commits out to master to keep this PR clean. @davwheat did you self-request review because you had some concerns?

[davwheat]

@tankerkiller125 No, sorry, just wanted to clear my review as I hadn't tested it locally after the rebase and stuff.

No real changes have taken place, and Sasha has no issues with it, so it's good with me.