How To: Configure Referrer-Policy and Feature-Policy Headers

Version Affected: All

 

Overview

This article covers SecureAuth's recommended values for the Referrer-Policy and Feature-Policy IIS response headers on the IdP.

Referrer-Policy: The recommended value is no-referrer-when-downgrade. This is the least likely to impact current and future integrations.

For increased security, strict-origin-when-cross-origin is also a safe value — it should not affect the IdP's own functionality, though it may occasionally impact an integration.

Do not set Referrer-Policy to no-referrer. This breaks Password Reset for any realm accessed remotely (for example, a realm set up in a DMZ) — Password Reset continues to work when accessed locally, but a remote user sees this error:

If your security requirements call for a stricter policy than no-referrer-when-downgrade and you still want Password Reset to keep working, use same-origin instead of no-referrer — it behaves the same as no-referrer for requests to other sites, but still sends the correct referrer when the IdP talks to itself over HTTPS, which Password Reset relies on.

Feature-Policy: There is currently no SecureAuth-recommended value for this header for improving IdP security.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.