Console: Add Referrer-Policy header

apps/i2psnark/java/src/org/klomp/snark/web/I2PSnarkServlet.java

@@ -388,6 +388,7 @@ public class I2PSnarkServlet extends BasicServlet {
         resp.setHeader("X-Frame-Options", "SAMEORIGIN");
         resp.setHeader("X-XSS-Protection", "1; mode=block");
         resp.setHeader("X-Content-Type-Options", "nosniff");
+        resp.setHeader("Referrer-Policy", "no-referrer");
     }
 
     private void writeMessages(PrintWriter out, boolean isConfigure, String peerString) throws IOException {

apps/i2ptunnel/java/src/net/i2p/i2ptunnel/localServer/LocalHTTPServer.java

@@ -196,6 +196,7 @@ public abstract class LocalHTTPServer {
             tbook = book;
         out.write(("HTTP/1.1 200 OK\r\n"+
                   "Content-Type: text/html; charset=UTF-8\r\n"+
+                  "Referrer-Policy: no-referrer\r\n"+
                   "Connection: close\r\n"+
                   "Proxy-Connection: close\r\n"+
                   "\r\n"+

apps/i2ptunnel/jsp/edit.jsp

@@ -6,6 +6,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page trimDirectiveWhitespaces="true"

apps/i2ptunnel/jsp/index.jsp

@@ -9,6 +9,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page trimDirectiveWhitespaces="true"

apps/i2ptunnel/jsp/wizard.jsp

@@ -9,6 +9,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %><%@page pageEncoding="UTF-8"
 %><%@page contentType="text/html" import="net.i2p.i2ptunnel.web.EditBean"

apps/routerconsole/jsp/css.jsi

@@ -36,6 +36,10 @@
       response.setHeader("X-XSS-Protection", "1; mode=block");
       response.setHeader("X-Content-Type-Options", "nosniff");
    }
+   // https://www.w3.org/TR/referrer-policy/
+   // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+   // As of Chrome 56, Firefox 50, Opera 43. "same-origin" not widely supported.
+   response.setHeader("Referrer-Policy", "no-referrer");
 
    String conNonceParam = request.getParameter("consoleNonce");
    if (net.i2p.router.web.CSSHelper.getNonce().equals(conNonceParam)) {

apps/susidns/src/jsp/addressbook.jsp

@@ -31,6 +31,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/config.jsp

@@ -31,6 +31,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/details.jsp

@@ -28,6 +28,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/index.jsp

@@ -31,6 +31,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susidns/src/jsp/subscriptions.jsp

@@ -31,6 +31,7 @@
     response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'");
     response.setHeader("X-XSS-Protection", "1; mode=block");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("Referrer-Policy", "no-referrer");
 
 %>
 <%@page pageEncoding="UTF-8"%>

apps/susimail/src/src/i2p/susi/webmail/WebMail.java

@@ -1637,6 +1637,7 @@ public class WebMail extends HttpServlet
                 response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'");
                 response.setHeader("X-XSS-Protection", "1; mode=block");
 		response.setHeader("X-Content-Type-Options", "nosniff");
+		response.setHeader("Referrer-Policy", "no-referrer");
 		RequestWrapper request = new RequestWrapper( httpRequest );
 		
 		SessionObject sessionObject = null;

installer/resources/proxy/ahelper-conflict-header.ht

@@ -1,5 +1,6 @@
 HTTP/1.1 409 Conflict
 Content-Type: text/html; charset=UTF-8
+Referrer-Policy: no-referrer
 Cache-control: no-cache
 Connection: close
 Proxy-Connection: close

installer/resources/proxy/ahelper-new-header.ht

@@ -1,5 +1,6 @@
 HTTP/1.1 409 New Address
 Content-Type: text/html; charset=UTF-8
+Referrer-Policy: no-referrer
 Cache-control: no-cache
 Connection: close
 Proxy-Connection: close

installer/resources/proxy/dnfh-header.ht

@@ -1,5 +1,6 @@
 HTTP/1.1 500 Domain Not Found
 Content-Type: text/html; charset=UTF-8
+Referrer-Policy: no-referrer
 Cache-control: no-cache
 Connection: close
 Proxy-Connection: close