Implement Cross-Origin-Opener-Policy Header

Addresses issue: #6176
freedomofpress · Dec 9, 2021 · bb426fa · bb426fa
1 parent 953c8bd
commit bb426fa
Show file tree

Hide file tree

Showing 8 changed files with 9 additions and 0 deletions.
diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf
@@ -33,6 +33,7 @@ Header onsuccess unset X-Download-Options
 Header always set X-Download-Options "noopen"
 Header onsuccess unset Content-Security-Policy
 Header always set Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+Header set Cross-Origin-Opener-Policy "same-origin"
 
 # Limit the max submitted size of requests.
 LimitRequestBody 524288000

diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf
@@ -54,6 +54,7 @@ Header onsuccess unset X-Download-Options
 Header always set X-Download-Options "noopen"
 Header onsuccess unset X-Content-Type-Options
 Header always set X-Content-Type-Options "nosniff"
+Header set Cross-Origin-Opener-Policy "same-origin"
 
 Header unset Etag
 

diff --git a/molecule/testinfra/vars/app-qubes-staging.yml b/molecule/testinfra/vars/app-qubes-staging.yml
@@ -5,6 +5,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
+
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "{{ securedrop_venv }}/bin"

diff --git a/molecule/testinfra/vars/app-staging.yml b/molecule/testinfra/vars/app-staging.yml
@@ -5,6 +5,7 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: /opt/venvs/securedrop-app-code/bin

diff --git a/molecule/testinfra/vars/prod.yml b/molecule/testinfra/vars/prod.yml
@@ -5,6 +5,7 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/prodVM.yml b/molecule/testinfra/vars/prodVM.yml
@@ -5,6 +5,7 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/qubes-staging.yml b/molecule/testinfra/vars/qubes-staging.yml
@@ -5,6 +5,7 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/staging.yml b/molecule/testinfra/vars/staging.yml
@@ -5,6 +5,7 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   X-Download-Options: noopen
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
+  Cross-Origin-Opener-Policy: "same-origin"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: /opt/venvs/securedrop-app-code/bin