secure_headers 3.1.2 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3ebe74bc751469bb4305dd36b59fe4881a87ec3d
-  data.tar.gz: 83fed6de7e4cab010cab6010caa0ba005ac43fc7
+  metadata.gz: c3acd5dfb3fc3a7c4037ef42b72765a4f1b34ede
+  data.tar.gz: 98f0ce842bac69bf7c5f4d3d4cc19e4281ebe00e
 SHA512:
-  metadata.gz: bd02880ba737a5a9489dd6e8209420259fec8d78330f5992e7b34f61ebe16677a93ff123dd3b417f6973bfcd85e03524b053bcd1487458492aa4c7b8a7a9bb40
-  data.tar.gz: 550c48cfd47e656e70dd3ab39ed6386b8d148231d55a553395da6076bc88bdaaa7fe1803695b093cf3e4fd49cb30bed0aff15a2455652efd00d7a27d9ce55636
+  metadata.gz: 75d3b9033b09f0ac40675e8e8706185d9c0ca465a38f857228bf56857f5f44ba1eab5559b9c9f64f34ee398226ccd9dda5e26923f5325dcadd7be8ff0a957314
+  data.tar.gz: f6ffb2babf72009e60a4d4663ee6e933db8f8acb7159021e66a07168e1c6743df621309fb63e884f3257217d28951b196b2a192739860ce459f4fbabbab35622

data/CHANGELOG.md

@@ -1,3 +1,129 @@
+## 3.3.0 referrer-policy support
+
+While not officially part of the spec and not implemented anywhere, support for the experimental [`referrer-policy` header](https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-header) was [preemptively added](https://github.com/twitter/secureheaders/pull/249).
+
+Additionally, two minor enhancements were added this version:
+1. [Warn when the HPKP report host is the same as the current host](https://github.com/twitter/secureheaders/pull/246). By definition any generated reports would be reporting to a known compromised connection.
+1. [Filter unsupported CSP directives when using Edge](https://github.com/twitter/secureheaders/pull/247). Previously, this was causing many warnings in the developer console.
+
+## 3.2.0 Cookie settings and CSP hash sources
+
+### Cookies
+
+SecureHeaders supports `Secure`, `HttpOnly` and [`SameSite`](https://tools.ietf.org/html/draft-west-first-party-cookies-07) cookies. These can be defined in the form of a boolean, or as a Hash for more refined configuration.
+
+__Note__: Regardless of the configuration specified, Secure cookies are only enabled for HTTPS requests.
+
+#### Boolean-based configuration
+
+Boolean-based configuration is intended to globally enable or disable a specific cookie attribute.
+
+```ruby
+config.cookies = {
+  secure: true, # mark all cookies as Secure
+  httponly: false, # do not mark any cookies as HttpOnly
+}
+```
+
+#### Hash-based configuration
+
+Hash-based configuration allows for fine-grained control.
+
+```ruby
+config.cookies = {
+  secure: { except: ['_guest'] }, # mark all but the `_guest` cookie as Secure
+  httponly: { only: ['_rails_session'] }, # only mark the `_rails_session` cookie as HttpOnly
+}
+```
+
+#### SameSite cookie configuration
+
+SameSite cookies permit either `Strict` or `Lax` enforcement mode options.
+
+```ruby
+config.cookies = {
+  samesite: {
+    strict: true # mark all cookies as SameSite=Strict
+  }
+}
+```
+
+`Strict` and `Lax` enforcement modes can also be specified using a Hash.
+
+```ruby
+config.cookies = {
+  samesite: {
+    strict: { only: ['_rails_session'] },
+    lax: { only: ['_guest'] }
+  }
+}
+```
+
+#### Hash
+
+`script`/`style-src` hashes can be used to whitelist inline content that is static. This has the benefit of allowing inline content without opening up the possibility of dynamic javascript like you would with a `nonce`.
+
+You can add hash sources directly to your policy :
+
+```ruby
+::SecureHeaders::Configuration.default do |config|
+   config.csp = {
+     default_src: %w('self')
+
+     # this is a made up value but browsers will show the expected hash in the console.
+     script_src: %w(sha256-123456)
+   }
+ end
+ ```
+
+ You can also use the automated inline script detection/collection/computation of hash source values in your app.
+
+ ```bash
+ rake secure_headers:generate_hashes
+ ```
+
+ This will generate a file (`config/config/secure_headers_generated_hashes.yml` by default, you can override by setting `ENV["secure_headers_generated_hashes_file"]`) containing a mapping of file names with the array of hash values found on that page. When ActionView renders a given file, we check if there are any known hashes for that given file. If so, they are added as values to the header.
+
+```yaml
+---
+scripts:
+  app/views/asdfs/index.html.erb:
+  - "'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg='"
+styles:
+  app/views/asdfs/index.html.erb:
+  - "'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY='"
+  - "'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE='"
+```
+
+##### Helpers
+
+**This will not compute dynamic hashes** by design. The output of both helpers will be a plain `script`/`style` tag without modification and the known hashes for a given file will be added to `script-src`/`style-src` when `hashed_javascript_tag` and `hashed_style_tag` are used. You can use `raise_error_on_unrecognized_hash = true` to be extra paranoid that you have precomputed hash values for all of your inline content. By default, this will raise an error in non-production environments.
+
+```erb
+<%= hashed_style_tag do %>
+body {
+  background-color: black;
+}
+<% end %>
+
+<%= hashed_style_tag do %>
+body {
+  font-size: 30px;
+  font-color: green;
+}
+<% end %>
+
+<%= hashed_javascript_tag do %>
+console.log(1)
+<% end %>
+```
+
+```
+Content-Security-Policy: ...
+ script-src 'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg=' ... ;
+ style-src 'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY=' 'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE=' ...;
+```
+
 ## 3.1.2 Bug fix for regression
 
 See https://github.com/twitter/secureheaders/pull/239

data/README.md

@@ -13,9 +13,10 @@ The gem will automatically apply several headers that are related to security.
 - X-Content-Type-Options - [Prevent content type sniffing](https://msdn.microsoft.com/library/gg622941\(v=vs.85\).aspx)
 - X-Download-Options - [Prevent file downloads opening](https://msdn.microsoft.com/library/jj542450(v=vs.85).aspx)
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
+- Referrer-Policy - [Referrer Policy draft](https://w3c.github.io/webappsec-referrer-policy/)
 - Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinning Specification](https://tools.ietf.org/html/rfc7469)
 
-It can also mark all http cookies with the secure attribute (when configured to do so).
+It can also mark all http cookies with the Secure, HttpOnly and SameSite attributes (when configured to do so).
 
 `secure_headers` is a library with a global config, per request overrides, and rack middleware that enables you customize your application settings.
 
@@ -31,13 +32,20 @@ All `nil` values will fallback to their default values. `SecureHeaders::OPT_OUT`
 
 ```ruby
 SecureHeaders::Configuration.default do |config|
-  config.secure_cookies = true # mark all cookies as "secure"
+  config.cookies = {
+    secure: true, # mark all cookies as "Secure"
+    httponly: true, # mark all cookies as "HttpOnly"
+    samesite: {
+      strict: true # mark all cookies as SameSite=Strict
+    }
+  }
   config.hsts = "max-age=#{20.years.to_i}; includeSubdomains; preload"
   config.x_frame_options = "DENY"
   config.x_content_type_options = "nosniff"
   config.x_xss_protection = "1; mode=block"
   config.x_download_options = "noopen"
   config.x_permitted_cross_domain_policies = "none"
+  config.referrer_policy = "origin-when-cross-origin"
   config.csp = {
     # "meta" values. these will shaped the header, but the values are not included in the header.
     report_only:  true,     # default: false
@@ -195,24 +203,6 @@ Code  | Result
 
 #### Nonce
 
-script/style-nonce can be used to whitelist inline content. To do this, call the `SecureHeaders.content_security_policy_nonce` then set the nonce attributes on the various tags.
-
-Setting a nonce will also set 'unsafe-inline' for browsers that don't support nonces for backwards compatibility. 'unsafe-inline' is ignored if a nonce is present in a directive in compliant browsers.
-
-```erb
-<script nonce="<%= content_security_policy_nonce %>">
-  console.log("whitelisted, will execute")
-</script>
-
-<script nonce="lol">
-  console.log("won't execute, not whitelisted")
-</script>
-
-<script>
-  console.log("won't execute, not whitelisted")
-</script>
-```
-
 You can use a view helper to automatically add nonces to script tags:
 
 ```erb
@@ -240,9 +230,93 @@ body {
 </style>
 ```
 
+```
+
+Content-Security-Policy: ...
+  script-src 'nonce-/jRAxuLJsDXAxqhNBB7gg7h55KETtDQBXe4ZL+xIXwI=' ...;
+  style-src 'nonce-/jRAxuLJsDXAxqhNBB7gg7h55KETtDQBXe4ZL+xIXwI=' ...;
+```
+
+`script`/`style-nonce` can be used to whitelist inline content. To do this, call the `content_security_policy_script_nonce` or `content_security_policy_style_nonce` then set the nonce attributes on the various tags.
+
+```erb
+<script nonce="<%= content_security_policy_script_nonce %>">
+  console.log("whitelisted, will execute")
+</script>
+
+<script nonce="lol">
+  console.log("won't execute, not whitelisted")
+</script>
+
+<script>
+  console.log("won't execute, not whitelisted")
+</script>
+```
+
 #### Hash
 
-The hash feature has been removed, for now.
+`script`/`style-src` hashes can be used to whitelist inline content that is static. This has the benefit of allowing inline content without opening up the possibility of dynamic javascript like you would with a `nonce`.
+
+You can add hash sources directly to your policy :
+
+```ruby
+::SecureHeaders::Configuration.default do |config|
+   config.csp = {
+     default_src: %w('self')
+
+     # this is a made up value but browsers will show the expected hash in the console.
+     script_src: %w(sha256-123456)
+   }
+ end
+ ```
+
+ You can also use the automated inline script detection/collection/computation of hash source values in your app.
+
+ ```bash
+ rake secure_headers:generate_hashes
+ ```
+
+ This will generate a file (`config/config/secure_headers_generated_hashes.yml` by default, you can override by setting `ENV["secure_headers_generated_hashes_file"]`) containing a mapping of file names with the array of hash values found on that page. When ActionView renders a given file, we check if there are any known hashes for that given file. If so, they are added as values to the header.
+
+```yaml
+---
+scripts:
+  app/views/asdfs/index.html.erb:
+  - "'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg='"
+styles:
+  app/views/asdfs/index.html.erb:
+  - "'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY='"
+  - "'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE='"
+```
+
+##### Helpers
+
+**This will not compute dynamic hashes** by design. The output of both helpers will be a plain `script`/`style` tag without modification and the known hashes for a given file will be added to `script-src`/`style-src` when `hashed_javascript_tag` and `hashed_style_tag` are used. You can use `raise_error_on_unrecognized_hash = true` to be extra paranoid that you have precomputed hash values for all of your inline content. By default, this will raise an error in non-production environments.
+
+```erb
+<%= hashed_style_tag do %>
+body {
+  background-color: black;
+}
+<% end %>
+
+<%= hashed_style_tag do %>
+body {
+  font-size: 30px;
+  font-color: green;
+}
+<% end %>
+
+<%= hashed_javascript_tag do %>
+console.log(1)
+<% end %>
+```
+
+```
+Content-Security-Policy: ...
+ script-src 'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg=' ... ;
+ style-src 'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY=' 'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE=' ...;
+```
 
 ### Public Key Pins
 
@@ -258,9 +332,58 @@ config.hpkp = {
     {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
   ],
   report_only: true,            # defaults to false (report-only mode)
-  report_uri: 'https://report-uri.io/example-hpkp',
-  app_name: 'example',
-  tag_report_uri: true
+  report_uri: 'https://report-uri.io/example-hpkp'
+}
+```
+
+### Cookies
+
+SecureHeaders supports `Secure`, `HttpOnly` and [`SameSite`](https://tools.ietf.org/html/draft-west-first-party-cookies-07) cookies. These can be defined in the form of a boolean, or as a Hash for more refined configuration.
+
+__Note__: Regardless of the configuration specified, Secure cookies are only enabled for HTTPS requests.
+
+#### Boolean-based configuration
+
+Boolean-based configuration is intended to globally enable or disable a specific cookie attribute.
+
+```ruby
+config.cookies = {
+  secure: true, # mark all cookies as Secure
+  httponly: false, # do not mark any cookies as HttpOnly
+}
+```
+
+#### Hash-based configuration
+
+Hash-based configuration allows for fine-grained control.
+
+```ruby
+config.cookies = {
+  secure: { except: ['_guest'] }, # mark all but the `_guest` cookie as Secure
+  httponly: { only: ['_rails_session'] }, # only mark the `_rails_session` cookie as HttpOnly
+}
+```
+
+#### SameSite cookie configuration
+
+SameSite cookies permit either `Strict` or `Lax` enforcement mode options.
+
+```ruby
+config.cookies = {
+  samesite: {
+    strict: true # mark all cookies as SameSite=Strict
+  }
+}
+```
+
+`Strict` and `Lax` enforcement modes can also be specified using a Hash.
+
+```ruby
+config.cookies = {
+  samesite: {
+    strict: { only: ['_rails_session'] },
+    lax: { only: ['_guest'] }
+  }
 }
 ```
 

data/lib/secure_headers/configuration.rb

@@ -1,3 +1,5 @@
+require 'yaml'
+
 module SecureHeaders
   class Configuration
     DEFAULT_CONFIG = :default
@@ -59,6 +61,7 @@ module SecureHeaders
         config.validate_config!
         @configurations ||= {}
         config.send(:cache_headers!)
+        config.send(:cache_hpkp_report_host)
         config.freeze
         @configurations[name] = config
       end
@@ -100,14 +103,24 @@ module SecureHeaders
       end
     end
 
+    attr_accessor :dynamic_csp
+
     attr_writer :hsts, :x_frame_options, :x_content_type_options,
       :x_xss_protection, :x_download_options, :x_permitted_cross_domain_policies,
-      :hpkp, :dynamic_csp, :secure_cookies
+      :referrer_policy
 
-    attr_reader :cached_headers, :csp, :dynamic_csp, :secure_cookies
+    attr_reader :cached_headers, :csp, :cookies, :hpkp, :hpkp_report_host
+
+    HASH_CONFIG_FILE = ENV["secure_headers_generated_hashes_file"] || "config/secure_headers_generated_hashes.yml"
+    if File.exists?(HASH_CONFIG_FILE)
+      config = YAML.safe_load(File.open(HASH_CONFIG_FILE))
+      @script_hashes = config["scripts"]
+      @style_hashes = config["styles"]
+    end
 
     def initialize(&block)
       self.hpkp = OPT_OUT
+      self.referrer_policy = OPT_OUT
       self.csp = self.class.send(:deep_copy, CSP::DEFAULT_CONFIG)
       instance_eval &block if block_given?
     end
@@ -117,7 +130,7 @@ module SecureHeaders
     # Returns a deep-dup'd copy of this configuration.
     def dup
       copy = self.class.new
-      copy.secure_cookies = @secure_cookies
+      copy.cookies = @cookies
       copy.csp = self.class.send(:deep_copy_if_hash, @csp)
       copy.dynamic_csp = self.class.send(:deep_copy_if_hash, @dynamic_csp)
       copy.cached_headers = self.class.send(:deep_copy_if_hash, @cached_headers)
@@ -127,7 +140,9 @@ module SecureHeaders
       copy.x_xss_protection = @x_xss_protection
       copy.x_download_options = @x_download_options
       copy.x_permitted_cross_domain_policies = @x_permitted_cross_domain_policies
+      copy.referrer_policy = @referrer_policy
       copy.hpkp = @hpkp
+      copy.hpkp_report_host = @hpkp_report_host
       copy
     end
 
@@ -166,30 +181,57 @@ module SecureHeaders
     def validate_config!
       StrictTransportSecurity.validate_config!(@hsts)
       ContentSecurityPolicy.validate_config!(@csp)
+      ReferrerPolicy.validate_config!(@referrer_policy)
       XFrameOptions.validate_config!(@x_frame_options)
       XContentTypeOptions.validate_config!(@x_content_type_options)
       XXssProtection.validate_config!(@x_xss_protection)
       XDownloadOptions.validate_config!(@x_download_options)
       XPermittedCrossDomainPolicies.validate_config!(@x_permitted_cross_domain_policies)
       PublicKeyPins.validate_config!(@hpkp)
+      Cookie.validate_config!(@cookies)
+    end
+
+    def secure_cookies=(secure_cookies)
+      Kernel.warn "#{Kernel.caller.first}: [DEPRECATION] `#secure_cookies=` is deprecated. Please use `#cookies=` to configure secure cookies instead."
+      @cookies = (@cookies || {}).merge(secure: secure_cookies)
     end
 
     protected
 
     def csp=(new_csp)
       if self.dynamic_csp
-        raise IllegalPolicyModificationError, "You are attempting to modify CSP settings directly. Use dynamic_csp= isntead."
+        raise IllegalPolicyModificationError, "You are attempting to modify CSP settings directly. Use dynamic_csp= instead."
       end
 
       @csp = new_csp
     end
 
+    def cookies=(cookies)
+      @cookies = cookies
+    end
+
     def cached_headers=(headers)
       @cached_headers = headers
     end
 
+    def hpkp=(hpkp)
+      @hpkp = hpkp
+    end
+
+    def hpkp_report_host=(hpkp_report_host)
+      @hpkp_report_host = hpkp_report_host
+    end
+
     private
 
+    def cache_hpkp_report_host
+      has_report_uri = @hpkp && @hpkp != OPT_OUT && @hpkp[:report_uri]
+      self.hpkp_report_host = if has_report_uri
+        parsed_report_uri = URI.parse(@hpkp[:report_uri])
+        parsed_report_uri.host
+      end
+    end
+
     # Public: Precompute the header names and values for this configuraiton.
     # Ensures that headers generated at configure time, not on demand.
     #

data/lib/secure_headers/hash_helper.rb

@@ -0,0 +1,10 @@
+require 'base64'
+
+module SecureHeaders
+  module HashHelper
+    def hash_source(inline_script, digest = :SHA256)
+      base64_hashed_content = Base64.encode64(Digest.const_get(digest).digest(inline_script)).chomp
+      "'#{digest.to_s.downcase}-#{base64_hashed_content}'"
+    end
+  end
+end

data/lib/secure_headers/headers/cookie.rb

@@ -0,0 +1,126 @@
+require 'cgi'
+require 'secure_headers/utils/cookies_config'
+
+module SecureHeaders
+  class CookiesConfigError < StandardError; end
+  class Cookie
+
+    class << self
+      def validate_config!(config)
+        CookiesConfig.new(config).validate!
+      end
+    end
+
+    attr_reader :raw_cookie, :config
+
+    def initialize(cookie, config)
+      @raw_cookie = cookie
+      @config = config
+      @attributes = {
+        httponly: nil,
+        samesite: nil,
+        secure: nil,
+      }
+
+      parse(cookie)
+    end
+
+    def to_s
+      @raw_cookie.dup.tap do |c|
+        c << "; secure" if secure?
+        c << "; HttpOnly" if httponly?
+        c << "; #{samesite_cookie}" if samesite?
+      end
+    end
+
+    def secure?
+      flag_cookie?(:secure) && !already_flagged?(:secure)
+    end
+
+    def httponly?
+      flag_cookie?(:httponly) && !already_flagged?(:httponly)
+    end
+
+    def samesite?
+      flag_samesite? && !already_flagged?(:samesite)
+    end
+
+    private
+
+    def parsed_cookie
+      @parsed_cookie ||= CGI::Cookie.parse(raw_cookie)
+    end
+
+    def already_flagged?(attribute)
+      @attributes[attribute]
+    end
+
+    def flag_cookie?(attribute)
+      case config[attribute]
+      when TrueClass
+        true
+      when Hash
+        conditionally_flag?(config[attribute])
+      else
+        false
+      end
+    end
+
+    def conditionally_flag?(configuration)
+      if(Array(configuration[:only]).any? && (Array(configuration[:only]) & parsed_cookie.keys).any?)
+        true
+      elsif(Array(configuration[:except]).any? && (Array(configuration[:except]) & parsed_cookie.keys).none?)
+        true
+      else
+        false
+      end
+    end
+
+    def samesite_cookie
+      if flag_samesite_lax?
+        "SameSite=Lax"
+      elsif flag_samesite_strict?
+        "SameSite=Strict"
+      end
+    end
+
+    def flag_samesite?
+      flag_samesite_lax? || flag_samesite_strict?
+    end
+
+    def flag_samesite_lax?
+      flag_samesite_enforcement?(:lax)
+    end
+
+    def flag_samesite_strict?
+      flag_samesite_enforcement?(:strict)
+    end
+
+    def flag_samesite_enforcement?(mode)
+      return unless config[:samesite]
+
+      case config[:samesite][mode]
+      when Hash
+        conditionally_flag?(config[:samesite][mode])
+      when TrueClass
+        true
+      else
+        false
+      end
+    end
+
+    def parse(cookie)
+      return unless cookie
+
+      cookie.split(/[;,]\s?/).each do |pairs|
+        name, values = pairs.split('=',2)
+        name = CGI.unescape(name)
+
+        attribute = name.downcase.to_sym
+        if @attributes.has_key?(attribute)
+          @attributes[attribute] = values || true
+        end
+      end
+    end
+  end
+end

data/lib/secure_headers/headers/policy_management.rb

@@ -91,6 +91,7 @@ module SecureHeaders
       UPGRADE_INSECURE_REQUESTS
     ].freeze
 
+    EDGE_DIRECTIVES = DIRECTIVES_1_0
     SAFARI_DIRECTIVES = DIRECTIVES_1_0
 
     FIREFOX_UNSUPPORTED_DIRECTIVES = [
@@ -118,6 +119,7 @@ module SecureHeaders
       "Opera" => CHROME_DIRECTIVES,
       "Firefox" => FIREFOX_DIRECTIVES,
       "Safari" => SAFARI_DIRECTIVES,
+      "Edge" => EDGE_DIRECTIVES,
       "Other" => CHROME_DIRECTIVES
     }.freeze
 

data/lib/secure_headers/headers/referrer_policy.rb

@@ -0,0 +1,33 @@
+module SecureHeaders
+  class ReferrerPolicyConfigError < StandardError; end
+  class ReferrerPolicy
+    HEADER_NAME = "Referrer-Policy"
+    DEFAULT_VALUE = "origin-when-cross-origin"
+    VALID_POLICIES = %w(
+      no-referrer
+      no-referrer-when-downgrade
+      origin
+      origin-when-cross-origin
+      unsafe-url
+    )
+    CONFIG_KEY = :referrer_policy
+
+    class << self
+      # Public: generate an Referrer Policy header.
+      #
+      # Returns a default header if no configuration is provided, or a
+      # header name and value based on the config.
+      def make_header(config = nil)
+        [HEADER_NAME, config || DEFAULT_VALUE]
+      end
+
+      def validate_config!(config)
+        return if config.nil? || config == OPT_OUT
+        raise TypeError.new("Must be a string. Found #{config.class}: #{config}") unless config.is_a?(String)
+        unless VALID_POLICIES.include?(config.downcase)
+          raise ReferrerPolicyConfigError.new("Value can only be one of #{VALID_POLICIES.join(', ')}")
+        end
+      end
+    end
+  end
+end