Set Referrer-Policy to no-referrer for media

matrix-org · Mar 5, 2020 · 352ca69 · 352ca69
1 parent 87972f0
commit 352ca69
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/changelog.d/7009.feature b/changelog.d/7009.feature
@@ -0,0 +1 @@
+Set `Referrer-Policy` header to `no-referrer` on media downloads.
diff --git a/synapse/rest/media/v1/download_resource.py b/synapse/rest/media/v1/download_resource.py
@@ -50,6 +50,9 @@ async def _async_render_GET(self, request):
             b" media-src 'self';"
             b" object-src 'self';",
         )
+        request.setHeader(
+            b"Referrer-Policy", b"no-referrer",
+        )
         server_name, media_id, name = parse_media_id(request)
         if server_name == self.server_name:
             await self.media_repo.get_local_media(request, media_id, name)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Set `Referrer-Policy` header to `no-referrer` on media downloads.