Ensure HTTP Header Referrer-Policy is set appropriately

NiedrigStufe 2Manuelle Prüfungapache

Beschreibung

The server now allows for controlling the amount of "referrer" information being sent with requests. Limiting information to only what is needed is security best practice. Manual review: the benchmark gives no reliable automated check for this control.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Perform the following steps to determine if the recommended state is implemented: Ensure a Header directive for Referrer-Policy is present in the Apache configuration and has the condition Header Set 'Referrer-Policy' shown below: # grep -I Referrer-Policy $APACHE_PREFIX/conf/httpd.conf Header set Referrer-Policy "<Directive>" If header Referrer-Policy configuration is present and has as a compliant value, then the server is compliant.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Perform the following to implement the recommended state: Add or modify the Header directive for the Referrer-Policy header in the Apache configuration to have the appropriate condition as shown below. Header set Referrer-Policy "<Directive>"

Eigenschaften

Betriebssysteme: Beliebig
Tags: apachefeatures
Referenz: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 5.17 Ensure HTTP Header Referrer-Policy is set appropriately